MetaMask / MetaMask/metamask-extension

[Bug]: With maximum privacy configuration, MetaMask doxxes the user to Linea and Base networks, despite configuration not to.

Open
#37,504 8 comments 0 reactions 0 assignees View on GitHub
area-privacy external-contributor regression-prod-13.7.0 Sev2-normal team-extension-platform type-bug
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

### Describe the bug

MetaMask sends user's address to Infura servers upon setup completion, even with all privacy related settings enabled.

### Expected behavior

User can use MetaMask to privately interact with the blockchain.

### Screenshots/Recordings

_No response_

### Steps to reproduce

1. Install MetaMask.
2. During initial setup, uncheck everything (maximize privacy/security).
3. Set a custom Ethereum RPC server.
4. Notice that MetaMask immediately makes several calls to Base and Linea Infura servers with the user's default address.

### Error messages or log output

```shell

```

### Detection stage

In production (default)

### Version

13.7.0

### Build type

None

### Browser

Brave

### Operating system

Windows

### Hardware wallet

_No response_

### Additional context

Personal Note: I have reported this bug and bugs almost identical to it multiple times. They keep getting fixed, which I'm happy about, but the same bug inevitably returns the next time MetaMask receives a new feature. It is exhausting to have to constantly report these privacy bugs over and over again, and it would be nice if MetaMask took a more proactive approach to privacy rather than being reactive to users *noticing* the privacy violations and reporting them.

Issues I have personally filed regarding privacy failures of MetaMask:
https://github.com/MetaMask/metamask-extension/issues/15169
https://github.com/MetaMask/metamask-extension/issues/15170
https://github.com/MetaMask/metamask-extension/issues/16754
https://github.com/MetaMask/metamask-extension/issues/27154
https://github.com/MetaMask/metamask-extension/issues/29428
https://github.com/MetaMask/metamask-extension/issues/37502

I upgraded because #29428 was allegedly fixed, but it seems that since then this new problem has been introduced.

### Severity

Significant privacy violation.

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue in MetaMask 13.7.0 by completing setup with privacy options disabled and a custom Ethereum RPC server, then inspect the network calls made to Base and Linea Infura endpoints. Trace the setup-completion path that initiates those requests. Done means the default address is not sent to those networks under the maximum-privacy configuration, with regression coverage for this scenario.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.