Social Recovery Ceremony

01Executive Summary

Social Recovery Ceremony is JIL Sovereign's protocol-native key recovery mechanism, designed to eliminate the single point of failure that causes an estimated $4 billion in permanently lost crypto assets each year. The system enables account holders to designate a set of trusted guardians who can collectively authorize key recovery through a multi-step, time-locked ceremony.

Unlike conventional social recovery schemes that rely on application-layer logic, JIL's implementation is embedded directly into the Layer 1 protocol. Recovery requests are submitted as on-chain transactions, guardian attestations are cryptographically verified by validators, and the mandatory 24-hour timelock is enforced at the consensus level. This architecture ensures that no single party - including JIL itself - can unilaterally recover or compromise an account.

02Problem Statement

Key loss remains the most significant barrier to mainstream crypto adoption. Chainalysis estimates that approximately 20% of all Bitcoin - over $100 billion - is locked in wallets whose owners have lost access to their private keys. Existing recovery mechanisms fall into two unsatisfactory categories.

Custodial Recovery

Centralized exchanges and custodians offer password reset flows, but this requires users to surrender sovereignty over their assets. Custodial recovery introduces counterparty risk, regulatory seizure risk, and the possibility of insider compromise. Users must trust the custodian's security practices, employee vetting, and business continuity.

Existing Social Recovery

Projects like Argent and Safe have pioneered guardian-based recovery, but their implementations suffer from critical limitations. Guardian attestations execute immediately without mandatory delay periods, leaving no window for the legitimate owner to detect and cancel fraudulent recovery attempts. Alert mechanisms are limited to single channels (typically push notifications), which can be silenced by an attacker who has physical access to the victim's device.

03Technical Architecture

The Social Recovery Ceremony operates through five distinct protocol components, each enforced at the L1 consensus layer.

Guardian Configuration

Account holders configure their guardian set through the guardian-attestor service. The default configuration is 3-of-5 guardians, meaning any three of five designated guardians must independently attest to a recovery request. Guardian addresses are stored on-chain in the Recovery Registry, and modifications to the guardian set require the account holder's signature plus a 48-hour delay to prevent last-minute guardian manipulation.

Recovery Flow

Initiator submits recovery request to Recovery Registry
  - Target account, new public key, guardian set hash
  - Recovery enters PENDING state
  - Alert Dispatcher fires on all channels

Guardians independently verify and submit attestations
  - Each attestation is an Ed25519 signature over the recovery request hash
  - Registry tracks attestation count

M-th attestation received - Timelock begins
  - 24-hour countdown enforced at block height
  - Second wave of alerts dispatched
  - Owner cancellation window open

Timelock expires - Key rotation executes
  - Old key material deactivated
  - New key material activated
  - Recovery enters COMPLETED state

04Implementation

The Social Recovery Ceremony is implemented across three JIL Sovereign services, with the core logic enforced by the L1 validator consensus.

Recovery Registry Contract

The on-chain registry maintains a mapping from account addresses to their guardian configurations and active recovery requests. Each recovery request is assigned a unique ceremony_id derived from the keccak256 hash of the target account, new key material, and block number. This prevents replay attacks and ensures each ceremony is uniquely identifiable.

Multi-Channel Alert System

When a recovery request transitions to PENDING, the Alert Dispatcher sends notifications through all registered channels within 30 seconds. Channel delivery is independent - failure of one channel does not block others.

Cancellation Mechanism

The legitimate account holder can cancel any active recovery ceremony by submitting a cancellation transaction signed with any key material currently associated with the account. This includes the primary key, any backup keys, or any MPC shard that can produce a valid signature. Cancellation is immediate and irrevocable - once cancelled, the same recovery request cannot be resubmitted for 72 hours.

05Integration with JIL Ecosystem

Social Recovery Ceremony integrates with multiple JIL Sovereign subsystems to provide a seamless recovery experience while maintaining the platform's security guarantees.

06Prior Art Differentiation

JIL's Social Recovery Ceremony introduces several novel elements not found in existing implementations.

07Implementation Roadmap

08Patent Claim