MetaMask / MetaMask/metamask-extension
[Privacy]: Cannot interact with MetaMask privately.
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
### What is this about?
By default, MetaMask comes with Ethereum, Linea, and Base RPC providers. You can provide your own, but you cannot remove the defaults. The UI suggests that if the provided RPC is down, the fallback will be used. There are a couple problems with this:
1. If the user doesn't have a Linea or Base RPC node (because they don't usually use those networks) they will continue to use the default RPC nodes. If they accidentally connect to any app that uses Linea or Base, they will then make a connection to those nodes despite the user wanting privcay.
2. The inability to remove the fallback means that if the user's provided RPC is down, the fallback will (presumably, according to the UI) be used. This means a transient outage of the user's primary RPC may cause a privacy data leakage.
### Scenario
_No response_
### Design
_No response_
### Technical Details
_No response_
### Threat Modeling Framework
Fixing this would address a privacy concern and allow users to use MetaMask without risk of being doxxed on accident by MetaMask, due to no fault of the user.
### Acceptance Criteria
_No response_
### Stakeholder review needed before the work gets merged
- [ ] Engineering (needed in most cases)
- [ ] Design
- [ ] Product
- [ ] QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- [ ] Security
- [ ] Legal
- [ ] Marketing
- [ ] Management (please specify)
- [ ] Other (please specify)
### References
_No response_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by locating the MetaMask UI and configuration handling for the default Ethereum, Linea, and Base RPC providers, then clarify the intended removal and fallback behavior with maintainers. Done should include agreed acceptance criteria and tests showing that users can avoid unintended connections to default providers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100