Replacing a guardian is basically updating the guardian list in the smart contract. Once the removal is confirmed on-chain, that address is permanently deleted from the list of "authorized signer guardians." A removed member can no longer start a valid recovery request.
Why the old guardian can no longer start a recovery
A social recovery is triggered only when a threshold number of guardians sign together. During signature verification, the smart contract checks the current guardian list in real time. Once removed, the old guardian's signature carries zero weight. In Candide's contract design, only the Owner can remove a Guardian. As soon as the revokeGuardianWithThreshold function is completed, the removed address loses all permissions of the Guardian role.
Step 1: Confirm the old guardian has been removed successfully
Check the on-chain state to make sure the removal actually took effect, not just "hidden" in the frontend.
How to do it: Search for your wallet address on a block explorer and look for event logs like
GuardianRemovedorRevokeGuardian. If you see the transaction and the block is confirmed, the removal is complete. Candide's contract states that only the Owner can callrevokeGuardianWithThreshold, and it takes effect immediately once invoked.How to know it's done: The block explorer shows the relevant event, and that address no longer appears in the wallet's guardian list. UniPass documentation also makes it clear that a guardian's weight in account recovery is managed by the smart contract; after removal, the weight drops to zero.
Step 2: Reset the recovery threshold (if necessary)
After removing a guardian, if the number of remaining guardians falls below the original threshold (for example, 3 out of 5 becomes 4 guardians left), you need to adjust the threshold as well. Otherwise, the recovery process can never be triggered again.
How to do it: In the guardian management screen, find the "Threshold setting" option and lower the number (for example, from 3 to 2 or to 3/4). This itself is a separate on-chain transaction and requires paying gas again.
How to know it's done: Both the guardian list and the threshold have been updated so that the threshold is equal to or less than the current number of guardians. Candide's
addGuardianWithThresholdmethod allows the Owner to set a new threshold at the same time when adding; the logic for removal works the same way.
High risk warning: If you remove a guardian but do not lower the threshold, any future recovery request won't be able to gather enough signatures. This effectively locks your recovery path. Many wallets will not remind you to adjust the threshold; it is the Owner's responsibility to keep this in check.
Common reasons for failure
The removal transaction was not confirmed before closing the wallet: If you close the page without waiting 10–20 seconds for confirmation, the transaction may still be sitting in the mempool, not yet on-chain. In theory, during that short window the old guardian could still start a recovery (if they manage to gather enough signatures before you). However, this would require both you and the old member to be online at the same time — an extremely unlikely scenario.
Mistakenly believing the old guardian's "invalid signature" applies to all contracts: Some wallets support "rotating guardians" — removing and adding in succession. Between those two transactions, if the old guardian happens to start a recovery request within the same block and their transaction gets packed first, there is a tiny theoretical overlap risk. But this is an extreme edge case and not a concern during normal use.
After the operation is complete
Verification: Go back to the wallet's guardian management page and refresh. Make sure the removed address is gone and the threshold shows correctly (for example "3/4").
Next step: If you replaced a guardian for a "security upgrade" (say you suspect the old member was phished), there is one more action to take on the removed address — ask that person to actively delete the wallet's authorization record from their own device. On-chain removal already cut off their permissions, but leftover local data could still leak privacy if read by malware.
