# Recovery Regain control of every account if a workspace's passkeys are lost Recovery is how a workspace regains its accounts. [Recovery signers](#recovery-signers) control the [Root account](https://splits.org/docs/accounts#root) at the recovery threshold, and because the Root owns every other account, they can reset any account's signers and threshold. ## Why recovery exists Splits never has custody of a workspace's assets, so there must be a way to regain them without passkeys. Passkeys are phishing-resistant because they're bound to the issuing domain. If splits.org went offline, or a passkey manager were compromised or lost, the passkeys would become unusable. Recovery signers are ordinary Ethereum keys. Signers that use external wallets work as long as the chain does. ## Recovery signers Recovery signers are EOAs chosen at [workspace setup](https://splits.org/docs/workspaces), controlling the Root at the recovery threshold set there. You can add two types: * **Email**: Splits creates a Privy embedded wallet for the email address. The signer authenticates with an email code when a recovery needs their signature. This option lets a trusted person help without managing a crypto wallet. Splits creates a separate wallet for each workspace the email is added to. * **Wallet**: add an EOA wallet address or ENS name. The signer connects that wallet when a recovery needs their signature. Use an address created for this purpose that has never signed a transaction anywhere; see [Keeping recovery healthy](#keeping-recovery-healthy). Recovery signers are the backstop beneath the day-to-day signers. [Settings > Recovery](https://app.splits.org/settings/team/recovery/) lists them for Owners. Changing them changes the workspace's account addresses ([why](#changing-recovery-signers)). ### Verifying recovery signers Confirm access to a recovery signer that uses an external wallet without moving funds: Splits has the key sign a test message. In *Settings > Recovery*, open the signer's three-dot menu → *Verify signer*; this requires connecting the wallet. Each verified signer shows when it was last verified. Verification signs the same kind of message a recovery does, so a signer that passes can sign a recovery; see [Known issues when using a Ledger](#known-issues-when-using-a-ledger) for wallets that fail it. **If a wallet won't disconnect**, navigate to another page and back, or disconnect from app.splits.org in the wallet extension. ### Known issues when using a Ledger Splits transactions are signed as a 32-byte hash (raw-bytes `personal_sign`, checked by the [account contracts](https://github.com/0xSplits/splits-contracts-monorepo/tree/main/packages/smart-vaults)). Wallets that re-encode that hash as text before signing produce a signature the contract rejects, and the app reports *Signature rejected*: * **Ledger Live** over WalletConnect decodes the hash as text and signs the corrupted result. * **The Rainbow browser extension** with a Ledger signs the hex string as text. Connect a Ledger through MetaMask instead. ## Recovering your accounts Recovery is the last resort: first confirm the passkeys are lost. [Verify your own](https://splits.org/docs/members/keys#verifying-access) at [Settings > Personal > Passkeys](https://app.splits.org/settings/personal/passkeys/), and check teammates' passkeys by hovering over the key icon on their row in [Settings > Members](https://app.splits.org/settings/team/members/). Recovery is a [signer reset](https://splits.org/docs/accounts/editing#resetting-signers) on the Treasury: because the Treasury's owner is the Root, the reset is signed by recovery signers at the recovery threshold instead of by passkeys. Run it from the Treasury's settings (*Reset signers*, also reachable from *Settings > Recovery*, which lists every account), choose the new signers and threshold, then connect each wallet or authenticate each email signer and sign. With the Treasury back under control, [reset any sub-account](https://splits.org/docs/accounts/editing#resetting-signers) the same way; sub-account resets are signed by the Treasury's signers, so no recovery wallets are needed. ## Changing recovery signers Account addresses are derived from the recovery configuration using [`CREATE2`](https://docs.openzeppelin.com/cli/2.8/deploying-with-create2). That's what makes every account's address identical on every network (including networks added later) while keeping custody fully with the workspace. The consequence: **changing recovery signers changes the workspace's account addresses.** The practical way to change them today is to create a new workspace. Email support to migrate your offchain data (members, contacts, on/offramp info, schedules), and remember to update any revenue or funding sources (smart contracts, invoices) to the new workspace's addresses. ## Keeping recovery healthy * [Verify recovery signers that use external wallets](#verifying-recovery-signers) periodically; each shows when it was last verified. * Use multiple signers on hardware wallets; at Splits we use a [2-of-3 with hardware wallets](https://splits.org/docs/resources/how-we-work#our-workspace). * **Use fresh addresses for wallet signers.** An Ethereum address is a hash of its public key, and the public key only appears onchain when the address signs. A recovery wallet that has never signed anywhere exposes nothing but that hash, which keeps it protected even if ECDSA, the signature scheme behind every Ethereum key, is ever weakened. An address you use day to day has already published its public key. Email signers get a new address per workspace, so they meet this by default. * **Don't reuse recovery wallets across workspaces.** The Root's signer set is public onchain, so one wallet on two workspaces links them; see [Privacy](https://splits.org/docs/workspaces/privacy).