Self-custody & recovery
Murk is non-custodial in the strongest sense: with your wallet alone, you can always recover and move your funds — even if our website, relayer, and indexer all vanish.
What you need to recover
Only four things, none of them ours to withhold:
- Your Solana wallet (re-derives all your Murk keys).
- An archival Solana RPC (the source of every event).
- The public circuit artifacts (open-source proving keys).
- The deployed program (permissionless spend instructions).
How recovery works
- Find your notes — every note's encrypted blob is emitted on-chain; trial-decrypt them with your viewing key and keep the ones that re-commit to your owner key.
- Rebuild the tree — every leaf is emitted at its authoritative index; reconstruct the Merkle tree and paths locally.
- Check what's spent — compute each note's nullifier and check it against the on-chain spent set.
- Prove and submit — generate proofs in your browser and self-submit to the program (it accepts any signer; the relayer is never required).
The role of our services
- The indexer is a cache of on-chain events — replaceable by a direct RPC scan.
- The relayer is a gasless/privacy convenience — you can always self-submit and pay your own gas.
Neither is a dependency for recovering funds; they're conveniences for a smooth experience.
The honest caveats
- Archival history — a full from-scratch recovery needs an RPC that still has the historical events; a pruned node can't reconstruct the tree. This is a Solana property, not a Murk one.
- The shipped wallet currently reads through the indexer and ships self-submit for deposits + consolidation; withdrawing/transferring without a relayer via the UI is on the roadmap, though the program permits it today.
- The admin pause can freeze new withdrawals (a liveness lever, not a way to take funds) — the program's upgrade authority is held under Squads multisig custody.
For details on trust roots, see Security model.