Recovery, Guardians, Inactivity and Claims
What to set in the advanced views and why: recovery authority, guardians and thresholds, add delays, inactivity sweeps, the vault and claims.
Last updated 2026-09-08 · maintained in the Final Wiki
Everything the advanced views let you set, what each setting does, and what happens if you go silent. Read the section "What recovery does not cover" before relying on any of it.
#The one-minute version
- Recovery exists for a lost key: a device that died, a file that is gone, a person who stopped responding. It always waits for your wallet to be inactive first, then for a delay, and any action of yours cancels it.
- You choose who may recover you: the default recovery authority, or your own guardians with a threshold. Guardians replace the authority; they do not add to it.
- After the same inactivity period, funds you left behind can be routed to a destination you chose. The default is the protocol's Final Chance Vault, where they wait for a claim.
- Recovery cannot take a wallet back from someone using a stolen key. That is what key rotation is for: a separate path, live today, that does not wait for inactivity (see "What recovery does not cover" below).
#Settings, one by one
| Setting | What it means | Default | Notes |
|---|---|---|---|
| Inactivity threshold | How long your wallet must be silent before recovery or routing can begin | 2 years | Measured from your last owner-authorized action on the wallet |
| Recovery delay | The wait between a queued new owner and finalization | 30 days | Any owner action during the wait cancels the queued recovery |
| Recovery authority | The single party that may queue a recovery when no guardians are set | Final Recovery Authority (chain-global) | Attests only once its attestors are armed; consulted only when guardian threshold is 0 |
| Guardians | Up to 32 addresses (Final Wallets or contracts) that may recover you together | none | Signatures are typed data only; each guardian signs the recovery intent directly |
| Guardian threshold | How many guardians must agree | 0 (authority mode) | Setting it above 0 switches the wallet to guardian mode and stops consulting the authority |
| Guardian add delay | The wait before a newly queued guardian becomes active | you choose | Queue, wait, finalize; cancel any time before finalization |
| Recovery validators | Optional contracts (passkey, email prover, hardware) with their own threshold | none | Checked after the authority or guardian branch; a true OR |
| Dormant funds destination | Where inactive balances may be routed after the threshold | Final Chance Vault | Cannot be unset; the vault is the safe default |
Plainly: recovery can begin only after two years of silence and completes after a further thirty days, through the recovery authority or through guardians you appoint; any action of yours cancels it; dormant funds can only ever go to the vault, where you claim them.
For PQ-enabled wallets, every guardian must itself be a PQ-enabled Final Wallet. The check runs when you set the guardian set and when an added guardian is finalized.
#How a recovery runs
- The inactivity threshold elapses with no owner action.
- The authority or a threshold of guardians queues a new owner.
- The recovery delay runs. Use your wallet during it and the recovery is cancelled.
- After the delay, the queued owner is finalized and ownership rotates. Your wallet address does not change; the recovery nonce advances.
Guardian signatures are EIP-712 typed data over the recovery intent. Plain message signatures are refused, so a guardian cannot be tricked into signing a recovery inside an unrelated prompt.
#Guardians: adding and removing
- Replace the whole set at once with a threshold. This is the immediate full-reset path; it clears any pending candidate.
- Add one guardian through the queue: queue, wait your add delay, finalize. Cancel while it waits if you change your mind.
- Keep the set small and reachable. Every recovery reads the whole set.
#Inactivity sweeps: dormant funds
After the same inactivity threshold, routing your dormant balances becomes permissionless: anyone may trigger it, and it moves selected native and token balances of the wallet and its sub-accounts to your configured destination. Nothing can be routed before the threshold, and your own activity resets the clock.
By default the destination is the Final Chance Vault. Routed entries are recorded per wallet, token, origin and time. If you set your own destination, that address receives the funds directly and the vault is not involved.
#Claims from the vault
- A claim names the routed entries you want back. It is submitted from a Final Wallet and reviewed; a claim receipt is issued as a token that tracks it.
- Claims carry an upfront fee in a fee token, capped by what you agree to.
- Still-unclaimed entries can be withdrawn by the treasury only after five full years.
#What recovery does not cover
Every recovery path waits for inactivity first. Someone using a stolen key is producing exactly the activity that keeps recovery from starting, so recovery is not the remedy for theft. It is still worth configuring: it does what it says for the case it covers — a key you lost, a device that died, a person who stopped responding.
What closes the gap is key rotation. It is live today and does not go through recovery at all, so the inactivity gate never applies. Your certificate already holds a spare recovery key; rotation promotes it into the live slots and commits a fresh spare in the same step, so your account is never without one. Only your recovery key can start a rotation, and your live key can never touch either slot. The delay is yours to set — 24 hours by default, one hour at the least, thirty days at most — and once it has run anyone can finalise, because the outcome is already fixed. Guardians can freeze spending while the delay runs, but can never rotate or take your keys; they may cancel a rotation at most twice, and each cancel restarts the delay rather than dropping the request, so a hostile or captured guardian set can delay you but never lock you out. It applies on every chain at once, because ownership moves in one registry rather than on each chain separately. No single credential can both immobilise your account and take it.
#Who holds your keys
All four keys are generated on your device and never leave it. Issuance receives commitments, never key material. Nobody at Final can sign for you. If you lose your keys and have no recovery configured, no copy exists to restore from.