Guardian Recovery and Multisig Look Alike and Protect Different Things

Both are arrangements where several people have to agree. That surface similarity is why they get compared, and the comparison usually misses that they are agreeing about different things.

What multisig governs

Spending. A multisig arrangement requires some number of keys out of a set to authorise moving value. No single key can spend alone, which is the whole point.

So its failure mode is about money. Lose too many keys and the funds are stuck; compromise enough and they are gone.

What guardian recovery governs

Rebinding an identifier to a new key. A threshold of guardians can authorise pointing your identifier at a key you generated on a new device.

It cannot move value. Recovery rebinds the identifier and never touches balances, because the identity key is a value-free anchor by design.

That is a safety property, not a limitation. A guardian set that could rebind a spending key is a guardian set that could steal, and a threshold of people who can take your money is a much more dangerous arrangement than a threshold who can restore your name.

We do not implement multisig

So there is no multisig account here. Value on this chain moves on a single signature, and the threshold arrangement we do have governs identity only.

A near-miss worth putting on the page

The chain's fee schedule declares a fee for a guardian-authorised recovery, and reading that constant alone would tell you recovery costs money.

It does not. Recovery is in the fee-exemption list, together with the other identifier and credential operations, and the exemption is applied before the balance check. A key with no balance can complete a recovery, which matters enormously, because the person recovering has by definition just lost everything and their new key is brand new.

The same pipeline does charge and balance-check the operations not on that list, so the exemption is a property of these operations rather than a fee system that never runs.

We are recording this because the constant is a label that describes something the code does not do, and reading it alone would have produced a confident, wrong conclusion that recovery is broken for exactly the person it exists for.

Choosing between them, if you are designing something

Protecting value from a single compromised key? That is multisig, and it is not what this wallet offers.

Protecting access from a lost device? That is guardian recovery, and it is what this wallet offers.

Wanting both? They compose, because they act on different keys, and combining them means two separate arrangements with two separate thresholds rather than one clever mechanism.

And note the human difference. Multisig co-signers are usually you, on other devices, or business partners. Guardians are people you will have to contact under pressure, years later. Choosing them is the hard part.