MetaMask / MetaMask/metamask-extension
[Bug]: MetaMask doxxes user even with all privacy options toggled.
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
**Describe the bug**
If you disable all of the analytics and phone home features in MetaMask settings and use a custom RPC server, it still sends the transaction details to `https://tx-sentinel-ethereum-mainnet.api.cx.metamask.io/`.
**Expected behavior**
When you disable the various privacy un-friendly settings, MetaMask will not doxx you to centralized servers.
**Steps to reproduce**
1. Go to MetaMask settings.
2. Navigate to Security & Privacy
3. Disable everything.
4. Add a custom network with a localhost or self-managed RPC server.
5. Initiate a transaction.
6. Notice that MetaMask sends the full transaction details to `https://tx-sentinel-ethereum-mainnet.api.cx.metamask.io/`
**Detection stage**
In production (default)
**Version**
12.2.3
**Build type**
None
**Browser**
Brave
**Operating system**
Windows
**Additional context**
MetaMask also makes external requests to the following as well when all privacy enhancements are enabled.
* https://price.api.cx.metamask.io/v2/chains/1/spot-prices - contains details about what tokens you are using (both background and popup send this)
* https://tx-sentinel-ethereum-mainnet.api.cx.metamask.io/networks - reveals that you are using MetaMask
**Severity**
Critical for privacy. Associating transactions with IP addresses is very bad.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue in MetaMask 12.2.3 by disabling all Security & Privacy options, using a localhost or self-managed RPC server, and initiating a transaction. Inspect requests to the listed tx-sentinel and price.api.cx.metamask.io endpoints, including the background and popup flows. Done means these external requests no longer expose transaction, network, or token details when privacy enhancements are enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100