MetaMask / MetaMask/metamask-extension
[Bug]: With maximum privacy configuration, MetaMask doxxes the user to Linea and Base networks, despite configuration not to.
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
### Describe the bug
MetaMask sends user's address to Infura servers upon setup completion, even with all privacy related settings enabled.
### Expected behavior
User can use MetaMask to privately interact with the blockchain.
### Screenshots/Recordings
_No response_
### Steps to reproduce
1. Install MetaMask.
2. During initial setup, uncheck everything (maximize privacy/security).
3. Set a custom Ethereum RPC server.
4. Notice that MetaMask immediately makes several calls to Base and Linea Infura servers with the user's default address.
### Error messages or log output
```shell
```
### Detection stage
In production (default)
### Version
13.7.0
### Build type
None
### Browser
Brave
### Operating system
Windows
### Hardware wallet
_No response_
### Additional context
Personal Note: I have reported this bug and bugs almost identical to it multiple times. They keep getting fixed, which I'm happy about, but the same bug inevitably returns the next time MetaMask receives a new feature. It is exhausting to have to constantly report these privacy bugs over and over again, and it would be nice if MetaMask took a more proactive approach to privacy rather than being reactive to users *noticing* the privacy violations and reporting them.
Issues I have personally filed regarding privacy failures of MetaMask:
https://github.com/MetaMask/metamask-extension/issues/15169
https://github.com/MetaMask/metamask-extension/issues/15170
https://github.com/MetaMask/metamask-extension/issues/16754
https://github.com/MetaMask/metamask-extension/issues/27154
https://github.com/MetaMask/metamask-extension/issues/29428
https://github.com/MetaMask/metamask-extension/issues/37502
I upgraded because #29428 was allegedly fixed, but it seems that since then this new problem has been introduced.
### Severity
Significant privacy violation.
Contributor guide
Research direction
Reproduce the issue in MetaMask 13.7.0 by completing setup with privacy options disabled and a custom Ethereum RPC server, then inspect the network calls made to Base and Linea Infura endpoints. Trace the setup-completion path that initiates those requests. Done means the default address is not sent to those networks under the maximum-privacy configuration, with regression coverage for this scenario.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100