# Recovery

Regain control of every account if a workspace's passkeys are lost

Recovery is how a workspace regains its accounts. [Recovery signers](#recovery-signers) control the [Root account](https://splits.org/docs/accounts#root) at the recovery threshold, and because the Root owns every other account, they can reset any account's signers and threshold.

## Why recovery exists

Splits never has custody of a workspace's assets, so there must be a way to regain them without passkeys. Passkeys are phishing-resistant because they're bound to the issuing domain. If splits.org went offline, or a passkey manager were compromised or lost, the passkeys would become unusable. Recovery signers are ordinary Ethereum keys. Signers that use external wallets work as long as the chain does.

## Recovery signers

Recovery signers are EOAs chosen at [workspace setup](https://splits.org/docs/workspaces), controlling the Root at the recovery threshold set there. You can add two types:

* **Email**: Splits creates a Privy embedded wallet for the email address. The signer authenticates with an email code when a recovery needs their signature. This option lets a trusted person help without managing a crypto wallet.
* **Wallet**: add an EOA wallet address or ENS name. The signer connects that wallet when a recovery needs their signature.

Recovery signers are the backstop beneath the day-to-day signers. [Settings > Recovery](https://app.splits.org/settings/team/recovery/) lists them for Owners. Changing them changes the workspace's account addresses ([why](#changing-recovery-signers)).

### Verifying recovery signers

Confirm access to a recovery signer that uses an external wallet without moving funds: Splits has the key sign a test message. In *Settings > Recovery*, open the signer's three-dot menu → *Verify signer*; this requires connecting the wallet. Each verified signer shows when it was last verified.

Verification signs the same kind of message a recovery does, so a signer that passes can sign a recovery; see [Known issues when using a Ledger](#known-issues-when-using-a-ledger) for wallets that fail it.

**If a wallet won't disconnect**, navigate to another page and back, or disconnect from app.splits.org in the wallet extension.

### Known issues when using a Ledger

Splits transactions are signed as a 32-byte hash (raw-bytes `personal_sign`, checked by the [account contracts](https://github.com/0xSplits/splits-contracts-monorepo/tree/main/packages/smart-vaults)). Wallets that re-encode that hash as text before signing produce a signature the contract rejects, and the app reports *Signature rejected*:

* **Ledger Live** over WalletConnect decodes the hash as text and signs the corrupted result.
* **The Rainbow browser extension** with a Ledger signs the hex string as text.

Connect a Ledger through MetaMask instead.

## Recovering your accounts

Recovery is the last resort: first confirm the passkeys are lost. [Verify your own](https://splits.org/docs/members/keys#verifying-access) at [Settings > Personal > Passkeys](https://app.splits.org/settings/personal/passkeys/), and check teammates' passkeys by hovering over the key icon on their row in [Settings > Members](https://app.splits.org/settings/team/members/).

Recovery is a [signer reset](https://splits.org/docs/accounts/editing#resetting-signers) on the Treasury: because the Treasury's owner is the Root, the reset is signed by recovery signers at the recovery threshold instead of by passkeys. Run it from the Treasury's settings (*Reset signers*, also reachable from *Settings > Recovery*, which lists every account), choose the new signers and threshold, then connect each wallet or authenticate each email signer and sign.

With the Treasury back under control, [reset any sub-account](https://splits.org/docs/accounts/editing#resetting-signers) the same way; sub-account resets are signed by the Treasury's signers, so no recovery wallets are needed.

## Changing recovery signers

Account addresses are derived from the recovery configuration using [`CREATE2`](https://docs.openzeppelin.com/cli/2.8/deploying-with-create2). That's what makes every account's address identical on every network (including networks added later) while keeping custody fully with the workspace. The consequence: **changing recovery signers changes the workspace's account addresses.**

The practical way to change them today is to create a new workspace. Email support to migrate your offchain data (members, contacts, on/offramp info, schedules), and remember to update any revenue or funding sources (smart contracts, invoices) to the new workspace's addresses.

## Keeping recovery healthy

* [Verify recovery signers that use external wallets](#verifying-recovery-signers) periodically; each shows when it was last verified.
* Use multiple signers on hardware wallets; at Splits we use a [2-of-3 with hardware wallets](https://splits.org/docs/resources/how-we-work#our-workspace).