Minerva accounts

Account lifecycle

1. 1

   Create

   An account address is derived with CREATE2 from the factory, the initial ML-DSA-65 key and a salt. It can receive funds before any contract exists, and it can deploy itself with its own first transaction.

2. 2

   Authorize

   Every native transaction carries the account, the public key, the algorithm, the policy version and a signature over a hash that binds chain id, nonce and the whole envelope. The node verifies it against the account's control record before gas is charged.

3. 3

   Rotate

   rotatePQKey, signed by the current key, writes the new key commitment and increments the policy version in the Account Control Registry. From that block the previous key is rejected on the native path at every policy version.

4. 4

   Delegate

   Device keys are enrolled with scopes: allowed targets or any, a value limit per window, an expiry, and protected targets no scope can include. Consensus admits a device key only for zero-value self-calls; the account contract enforces the scope.

5. 5

   Recover

   Today recovery means restoring the encrypted ML-DSA key from the Recovery Kit and rotating. Policy-based recovery (guardians) would end in the same registry write; it is planned, not shipped.

The diagram follows the implemented model. The steps marked as planned are design targets and are labeled as such on the Core v1 page.