Recovery
Guardians can restore access to a lost account through an audited social-recovery module - and they can never spend from it.
Recovery is how you get back into your account if you lose every device that could sign for it - without a seed phrase, and without ever handing anyone a key. It's built on an audited on-chain module, and it's strictly limited to restoring access: a guardian can never move your funds.
Guardians restore access, never spend
A guardian is an address you nominate ahead of time. Together, your guardian set and a threshold you choose gate a single ability: rotating your account's root signer to a new device you control. That's all a guardian can ever do - there's no path from being a guardian to being able to spend from your account.
Guardians can only restore access to your account. They can never spend from it, under any circumstances.
Two separate signer lanes
Setting up recovery and actually using it go through two different lanes:
- Config - adding a guardian or installing the recovery module is something you sign, on your normal owner lane, the same as any other account change.
- Recovery - actually rotating your root signer is something your guardians sign, under a separate nonce lane dedicated to recovery. You are not part of this signature at all - which is exactly what makes recovery work when you've lost every device you'd otherwise sign with.
Your guardian set
The module itself is permissive - it would allow as few as one guardian with a threshold of one. Botanary sets a stricter floor: at least two guardians, and a threshold of at least two, so a single guardian can never unilaterally rotate your account on their own. If you don't set a threshold explicitly, the suggested default is a strict majority of your guardian count - a 2-of-3 set, for example, or 3-of-5.
Any address you nominate is accepted as a guardian except a malformed address, the zero address, or your account's own address.
Install the module and set your guardians
Installing recovery, and setting your full guardian set and threshold, happens as one operation that you sign once. It's sent in a way that doesn't get caught by your own account rules, so turning on recovery never conflicts with rules you've already set.
Add a guardian with an on-chain address
If you give a guardian a real on-chain address, adding them writes that guardian into the recovery module on-chain. If you add one without an address, it's recorded for reference only and isn't yet part of the on-chain set.
Recovering a lost device
Recovery rotates your root signer in two ordered steps - the new device is added first, then the lost one is removed - both guardian-signed, relayed in that order. The device you're replacing has to currently be a live signer on your account for this to work.
Recovery is for a lost device, not a compromised one
Recovery adds your new device before it removes the lost one, which means the lost device is technically still valid for a brief window while both operations are in flight. That's fine for a device you've simply lost - but if a device may be in someone else's hands, don't use recovery for it. Freeze the account instead; see The smart account for how freezing works.
Lost a device: use recovery. Think a device may be compromised: freeze your account first, don't start a recovery.
What's not on-chain yet
Removing a guardian currently updates Botanary's own record of your guardian set; it doesn't yet also remove that guardian from the on-chain module itself. Adding a guardian with a real address does write on-chain immediately - it's specifically the remove path that's still record-only.
TODO: guardian management (adding, removing, and enabling guardians) is presented in the app as coming soon while a dedicated recovery readiness check rolls out. A read-only explainer for recovering a lost device is available regardless - verify current in-app availability before publishing step-by-step guardian setup instructions.