# Ethereum Transit Authority

Source: https://ethereumtransitauthority.com
Kiwi News: https://news.kiwistand.com/stories/Ethereum-Transit-Authority?index=0x6af24d7c30f6e464718ac516c3ce2798b0b047f15070abe5db29aed0ab22924e633f887b
Submitted by misha on 2026-11-09 UTC, 2 upvotes, 0 comments

## Summary

Ethereum Transit Authority maps which outside services learn about a user's activity when sending ETH from different wallets, and states that even a self-run node still exposes some data. In the default MetaMask extension send, 12 requests reach Consensys services, Blockaid, Infura, Etherscan and Segment, including the user's IP address and the unsigned transaction. The Rabby send on v0.94.3 has 17 requests across 14 stations, mainly to Rabby's DeBank API, Hyperliquid, Etherscan and Google Analytics. Even the self-run node route still sends the signed transaction to builders and relays.

## Article

ETA

codesandbox

M1Normie Send · 12 stops R1Rabby Send · 14 stops M2ENS Send · 15 stops M0Mountain Man · 7 stops, 5 at home M3Aave Deposit · 19 stops PWPlain Wallet Send · 6 stops RB1Rainbow Send · 11 stops AB1Ambire Send · 7 stops U1Uniswap Swap · 22 stops M4MetaMask Swap · 14 stops MTToken Send · 13 stops APToken Approval · 14 stops, 1 at home ONFiat On-Ramp · 4 stops BRL2 Bridge · 14 stops OFFiat Off-Ramp · 8 stops RCRecovery · 3 stops, 1 at home RTRabby Token Send · 15 stops RBTRainbow Token Send · 12 stops RSRabby Swap · 18 stops RBSRainbow Swap · 14 stops RAPRabby Token Approval · 16 stops RBARainbow Token Approval · 12 stops CB1Coinbase Wallet Send · 11 stops PH1Phantom Send · 10 stops CBTCoinbase Wallet Token Send · 11 stops PHTPhantom Token Send · 10 stops CBSCoinbase Wallet Swap · 10 stops CBACoinbase Wallet Token Approval · 10 stops PHSPhantom Swap · 10 stops PHAPhantom Token Approval · 10 stops FR1Frame Send · 7 stops NNight Service · 9 stops !Top Gaps ◉Your Own Node ⇉Leverage ✓Evidence ≡Access Vectors ⚙Gadget Shelf ★Interchanges ▲Fixes iStation Index

M1The Normie Send7 lines · 12 stations · 12 requests⚗ mainnet tx R1The Rabby Send7 lines · 14 stations · 17 requests⚗ mainnet tx M2The ENS Send8 lines · 15 stations · 15 requests⚗ mainnet tx M0The Mountain Man6 lines · 7 stations · 7 requests M3The Aave Deposit8 lines · 19 stations · 26 requests⚗ mainnet tx PWThe Plain Wallet Send6 lines · 6 stations · 11 requests⚗ mainnet tx RB1The Rainbow Send7 lines · 11 stations · 14 requests⚗ mainnet tx AB1The Ambire Send8 lines · 7 stations · 9 requests U1The Uniswap Swap7 lines · 22 stations · 26 requests⚗ lab-tested M4The MetaMask Swap7 lines · 14 stations · 14 requests⚗ mainnet tx MTThe Token Send7 lines · 13 stations · 13 requests⚗ mainnet tx APThe Token Approval7 lines · 14 stations · 14 requests⚗ mainnet tx ONThe Fiat On-Ramp3 lines · 4 stations · 4 requests⚗ lab-tested BRThe L2 Bridge7 lines · 14 stations · 14 requests⚗ lab-tested OFThe Fiat Off-Ramp6 lines · 8 stations · 8 requests⚗ lab-tested RCThe Recovery4 lines · 3 stations · 3 requests⚗ lab-tested RTThe Rabby Token Send6 lines · 15 stations · 18 requests⚗ mainnet tx RBTThe Rainbow Token Send7 lines · 12 stations · 15 requests⚗ mainnet tx RSThe Rabby Swap5 lines · 18 stations · 21 requests⚗ mainnet tx RBSThe Rainbow Swap5 lines · 14 stations · 17 requests⚗ mainnet tx RAPThe Rabby Token Approval6 lines · 16 stations · 19 requests⚗ mainnet tx RBAThe Rainbow Token Approval6 lines · 12 stations · 15 requests⚗ mainnet tx CB1The Coinbase Wallet Send8 lines · 11 stations · 12 requests⚗ mainnet tx PH1The Phantom Send8 lines · 10 stations · 10 requests⚗ mainnet tx CBTThe Coinbase Wallet Token Send8 lines · 11 stations · 12 requests⚗ mainnet tx PHTThe Phantom Token Send8 lines · 10 stations · 10 requests⚗ mainnet tx CBSThe Coinbase Wallet Swap8 lines · 10 stations · 11 requests⚗ mainnet tx CBAThe Coinbase Wallet Token Approval8 lines · 10 stations · 11 requests⚗ mainnet tx PHSThe Phantom Swap8 lines · 10 stations · 10 requests⚗ mainnet tx PHAThe Phantom Token Approval8 lines · 10 stations · 10 requests⚗ mainnet tx FR1The Frame Send7 lines · 7 stations · 7 requests⚗ mainnet tx NNight Service4 lines · 9 stations · 15 requests⚗ lab-tested

!Top Gapsthe dependencies you can't route around today, one at a time: who, what they see, what would have to exist→ ◉Your Own Nodeeach wallet pointed at your node: what your node answers, what still leaves→ ⇉Leverageall flows' leaks summed — which gadget & which company sees the most, and where there's no escape→ ✓Evidencehow much of the map is live-observed vs code-traced — and what still needs a capture→ ≡Access Vectorsactors as categories, ranked by reach × exposure, with the zero-option→ ⚙Gadget Shelfwhat the Mountain Man must run himself for each gadget — and its cost→ ★Interchangesbusiest stations across all maps→ ▲Fixeswhat to build, ranked by the risk it removes→ iStation Indexevery station, what it gets, how to skip it→ ?How to read a maplegend and a worked example→ M4Swapplanned M5LP Rebalanceplanned

← ALL MAPS

?How to read a map

An example

← ALL MAPS

M1The Normie Send

MetaMask extension · mainnet · defaults · address pasted in.

⚗ lab run 20260821-193024-send-eth · mainnet tx 0xf6bd6355…92c1 ↗ · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Consensys · MM APIs Your IP address → Consensys · SERVO relay Your IP address → Blockaid Your IP address → Consensys · Infura Your IP address → Etherscan Your IP address → Segment Your IP address → Google · Web Store Your IP address → Sentry Your address → Consensys · MM APIs Your address → Consensys · SERVO relay Your address → Blockaid Your address → Consensys · Infura ALL your addresses → Consensys · MM APIs ALL your addresses → Consensys · Infura Your login token → Consensys · MM APIs Your login token → Consensys · SERVO relay Your tracking ID → Segment Cookies → Etherscan Which tokens you hold → Consensys · MM APIs Who you're paying → Consensys · SERVO relay Who you're paying → Blockaid How much → Consensys · SERVO relay The whole unsigned tx → Consensys · MM APIs The whole unsigned tx → Blockaid The whole unsigned tx → Consensys · Infura THE SIGNED TX → Consensys · SERVO relay THE SIGNED TX → Builders · relays The tx hash → Consensys · SERVO relay The tx hash → Consensys · Infura The tx hash → Etherscan Your IP address Your address ALL your addresses Your login token Your tracking ID Cookies Which tokens you hold Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Consensys · MM APIs can stop you can swap the code you run writes into your tx Consensys · SERVO relay can stop you can show you wrong numbers Blockaid can stop you can show you wrong numbers writes into your tx Consensys · Infura can stop you can get your funds stuck writes into your tx Etherscan can show you wrong numbers Segment even when you do nothing only if you opted in Google · Web Store can stop you can swap the code you run even when you do nothing Sentry even when you do nothing only if you opted in Builders · relays can stop you

← ALL MAPS

R1The Rabby Send

Same send as M1, in Rabby (v0.94.3) · mainnet · defaults · address pasted in. The contrast route: one open-source client, one backend.

⚗ lab run 20260929-162946-send-eth-rabby-localnode — real send with Ethereum set to your node in Rabby's UI · mainnet tx 0xf7b2131a…d5fd ↗ · ⚗ lab run 20260924-212508-send-eth-rabby — dry, Rabby 0.94.6: unlock → Send → sign bar; stopped before Confirm · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE AWS CLOUDFRONT READS ALL OF THESE FIRST Your IP address → Rabby · DeBank API Your IP address → Hyperliquid Your IP address → Etherscan Your IP address → Google Analytics Your IP address → Sentry Your address → Rabby · DeBank API Your address → Hyperliquid ALL your addresses → Rabby · DeBank API Your device ID → Rabby · DeBank API Your device ID → Google Analytics Cookies → Etherscan Which dapp you're on → Rabby · DeBank API Who you're paying → Rabby · DeBank API How much → Rabby · DeBank API The whole unsigned tx → Rabby · DeBank API THE SIGNED TX → Rabby · DeBank API THE SIGNED TX → Builders · relays The tx hash → Rabby · DeBank API The tx hash → Etherscan Your IP address Your address ALL your addresses Your device ID Cookies Which dapp you're on Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Rabby · DeBank API can stop you can swap the code you run writes into your tx Hyperliquid can show you wrong numbers Etherscan can show you wrong numbers only if you click Google Analytics even when you do nothing Sentry even when you do nothing Builders · relays can stop you

← ALL MAPS

M2The ENS Send

M1, but you type tim.eth.

⚗ lab run 20260824-191831-send-ens-mainnet · mainnet tx 0x8ef0a228…a3cf ↗ · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Consensys · MM APIs Your IP address → Consensys · SERVO relay Your IP address → Blockaid Your IP address → Consensys · Infura Your IP address → Etherscan Your IP address → Segment Your IP address → Avatar host Your IP address → CCIP gateway Your IP address → Google · Web Store Your IP address → Sentry Your address → Consensys · MM APIs Your address → Consensys · SERVO relay Your address → Blockaid Your address → Consensys · Infura ALL your addresses → Consensys · MM APIs ALL your addresses → Consensys · Infura Your login token → Consensys · MM APIs Your login token → Consensys · SERVO relay Your tracking ID → Segment Cookies → Etherscan Which tokens you hold → Consensys · MM APIs The name you typed → Consensys · Infura The name you typed → Avatar host The name you typed → CCIP gateway Who you're paying → Consensys · SERVO relay Who you're paying → Blockaid How much → Consensys · SERVO relay The whole unsigned tx → Consensys · MM APIs The whole unsigned tx → Blockaid The whole unsigned tx → Consensys · Infura THE SIGNED TX → Consensys · SERVO relay THE SIGNED TX → Builders · relays The tx hash → Consensys · SERVO relay The tx hash → Consensys · Infura The tx hash → Etherscan Your IP address Your address ALL your addresses Your login token Your tracking ID Cookies Which tokens you hold The name you typed Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Consensys · MM APIs can stop you can swap the code you run writes into your tx Consensys · SERVO relay can stop you can show you wrong numbers Blockaid can stop you can show you wrong numbers writes into your tx Consensys · Infura can stop you can make you lose funds writes into your tx Etherscan can show you wrong numbers Segment even when you do nothing only if you opted in Avatar host CCIP gateway can stop you can make you lose funds writes into your tx only if you click Google · Web Store can stop you can swap the code you run even when you do nothing Sentry even when you do nothing only if you opted in Builders · relays can stop you

← ALL MAPS

M0The Mountain Man

He owns every step against his own node — but "clean" hides the cost. HIS SHELF (below) shows the gadgets he must self-run to match the centralized players (green, with cost) and the ones that are simply MISSING (red). The self-run map was lying by omission.

route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE Your IP address → Ethereum p2p THE SIGNED TX → Ethereum p2p THE SIGNED TX → Builders · relays Your IP address THE SIGNED TX Ethereum p2p Builders · relays can stop you

← ALL MAPS

M3The Aave Deposit

app.aave.com + MetaMask · deposit ETH. The dApp's stations, then the M1 track.

⚗ lab run 20260824-203044-deposit-aave · mainnet tx 0x84fa74dd…8db6 ↗ · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Consensys · MM APIs Your IP address → Consensys · SERVO relay Your IP address → Blockaid Your IP address → Avara · app.aave.com Your IP address → Merkl Your IP address → Consensys · Infura Your IP address → Alchemy Your IP address → Etherscan Your IP address → ACI · aavechan Your IP address → Amplitude Your IP address → Compliance vendor Your IP address → ENS metadata Your IP address → Segment Your IP address → The Graph Your IP address → WalletConnect Your IP address → CoinGecko Your IP address → Family Your IP address → GitHub Your IP address → Google · Web Store Your IP address → Sentry Your address → Consensys · MM APIs Your address → Consensys · SERVO relay Your address → Blockaid Your address → Consensys · Infura Your address → Alchemy Your address → ACI · aavechan Your address → Amplitude Your address → Compliance vendor Your address → ENS metadata Your address → The Graph Your address → WalletConnect ALL your addresses → Consensys · MM APIs ALL your addresses → Consensys · Infura Your login token → Consensys · MM APIs Your login token → Consensys · SERVO relay Your tracking ID → Segment Cookies → Etherscan Which tokens you hold → Consensys · MM APIs Your balances → Alchemy Who you're paying → Consensys · SERVO relay Who you're paying → Blockaid How much → Consensys · SERVO relay The whole unsigned tx → Consensys · MM APIs The whole unsigned tx → Blockaid The whole unsigned tx → Consensys · Infura THE SIGNED TX → Consensys · SERVO relay THE SIGNED TX → Builders · relays The tx hash → Consensys · SERVO relay The tx hash → Consensys · Infura The tx hash → Etherscan Your IP address Your address ALL your addresses Your login token Your tracking ID Cookies Which tokens you hold Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Consensys · MM APIs can stop you can swap the code you run writes into your tx Consensys · SERVO relay can stop you can show you wrong numbers Blockaid can stop you can show you wrong numbers writes into your tx Avara · app.aave.com can stop you can swap the code you run writes into your tx Merkl can show you wrong numbers Consensys · Infura can stop you can get your funds stuck writes into your tx Alchemy can stop you can show you wrong numbers Etherscan can show you wrong numbers ACI · aavechan can show you wrong numbers Amplitude only if you click Compliance vendor can stop you can get your funds stuck writes into your tx ENS metadata Segment even when you do nothing only if you opted in The Graph can show you wrong numbers WalletConnect can stop you CoinGecko Family can show you wrong numbers GitHub can show you wrong numbers Google · Web Store can stop you can swap the code you run even when you do nothing Sentry Builders · relays can stop you

← ALL MAPS

PWThe Plain Wallet Send

Same send as M1, in Plain Wallet (0.1.8) · mainnet · defaults · address pasted in. One RPC, and nothing else. · announcement ↗ · source ↗

⚗ lab run 20260924-135055-send-eth-plain · mainnet tx 0x7215ce9e…3063 ↗ · ⚗ lab run 20260924-133441-send-eth-plain — dry: unlock → balances → Review slip; stopped before Send · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Reth · public RPC Your IP address → DeBank Your IP address → GitHub Your address → Reth · public RPC Your address → DeBank Your device ID → Reth · public RPC Cookies → DeBank Who you're paying → Reth · public RPC How much → Reth · public RPC The whole unsigned tx → Reth · public RPC THE SIGNED TX → Reth · public RPC THE SIGNED TX → Builders · relays The tx hash → Reth · public RPC Your IP address Your address Your device ID Cookies Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Reth · public RPC can stop you can get your funds stuck writes into your tx DeBank can show you wrong numbers GitHub can swap the code you run even when you do nothing Builders · relays can stop you

← ALL MAPS

RB1The Rainbow Send

Same send as M1, in Rainbow (1.6.11) · mainnet · defaults · address pasted in. One vendor owns the RPC, the balances and the confirmation; nothing is simulated or screened.

⚗ lab run 20260824-192602-send-eth-rainbow · mainnet tx 0xf2954ed1…068b ↗ · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Rainbow · RPC proxy Your IP address → Rainbow · APIs Your IP address → Etherscan Your IP address → RudderStack Your IP address → Google · Firebase Your IP address → Sentry Your IP address → Google · Web Store Your address → Rainbow · RPC proxy Your address → Rainbow · APIs Your device ID → RudderStack Your device ID → Google · Firebase Your device ID → Sentry Cookies → Etherscan Who you're paying → Rainbow · RPC proxy How much → Rainbow · RPC proxy How much → RudderStack The whole unsigned tx → Rainbow · RPC proxy THE SIGNED TX → Rainbow · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Rainbow · APIs The tx hash → Etherscan Your IP address Your address Your device ID Cookies Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Rainbow · RPC proxy can stop you can make you lose funds writes into your tx Rainbow · APIs can stop you can make you lose funds writes into your tx Etherscan can show you wrong numbers only if you click RudderStack Google · Firebase can stop you can swap the code you run even when you do nothing Sentry even when you do nothing Google · Web Store can stop you can swap the code you run even when you do nothing Builders · relays can stop you

← ALL MAPS

AB1The Ambire Send

The same send, in Ambire (6.18.7) · mainnet · defaults · address pasted in. Not an EOA tx — a 4337 UserOperation: Ambire's relayer co-signs it as paymaster, Pimlico bundles it, and every hop terminates at Cloudflare.

route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Pimlico bundler Your IP address → Ambire · relayer Your IP address → Ambire · invictus RPC Your IP address → Ambire · cena Your IP address → Ambire · monitor Your IP address → Google · Web Store Your address → Pimlico bundler Your address → Ambire · relayer Your address → Ambire · invictus RPC ALL your addresses → Ambire · relayer Which tokens you hold → Ambire · cena Who you're paying → Pimlico bundler Who you're paying → Ambire · relayer Who you're paying → Ambire · invictus RPC How much → Pimlico bundler How much → Ambire · relayer How much → Ambire · invictus RPC The whole unsigned tx → Pimlico bundler The whole unsigned tx → Ambire · relayer The whole unsigned tx → Ambire · invictus RPC The tx hash → Pimlico bundler Your IP address Your address ALL your addresses Which tokens you hold Who you're paying How much The whole unsigned tx The tx hash Pimlico bundler can stop you can make you lose funds writes into your tx Ambire · relayer can stop you can get your funds stuck writes into your tx Ambire · invictus RPC can stop you can get your funds stuck writes into your tx Ambire · cena can show you wrong numbers even when you do nothing Ambire · monitor even when you do nothing Google · Web Store can stop you can swap the code you run even when you do nothing Builders · relays can stop you

← ALL MAPS

U1The Uniswap Swap

app.uniswap.org + MetaMask · swap ETH→USDC. One company computes the route AND the calldata you sign; then the M1 wallet track.

⚗ lab run 20260824-095240-swap-uniswap — dry — reached the swap confirm; wallet connect click failed silently, portfolio legs missing · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Uniswap Labs Your IP address → Consensys · MM APIs Your IP address → Consensys · SERVO relay Your IP address → Blockaid Your IP address → Consensys · Infura Your IP address → Etherscan Your IP address → Datadog Your IP address → Segment Your IP address → GitHub Your IP address → Google · Web Store Your IP address → Sentry Your address → Uniswap Labs Your address → Consensys · MM APIs Your address → Consensys · SERVO relay Your address → Blockaid Your address → Consensys · Infura ALL your addresses → Consensys · MM APIs ALL your addresses → Consensys · Infura Your login token → Consensys · MM APIs Your login token → Consensys · SERVO relay Your tracking ID → Segment Your device ID → Uniswap Labs Your device ID → Datadog Cookies → Etherscan Which tokens you hold → Consensys · MM APIs Your balances → Uniswap Labs Who you're paying → Consensys · SERVO relay Who you're paying → Blockaid How much → Uniswap Labs How much → Consensys · SERVO relay The whole unsigned tx → Consensys · MM APIs The whole unsigned tx → Blockaid The whole unsigned tx → Consensys · Infura THE SIGNED TX → Consensys · SERVO relay THE SIGNED TX → Builders · relays The tx hash → Uniswap Labs The tx hash → Consensys · SERVO relay The tx hash → Consensys · Infura The tx hash → Etherscan Your IP address Your address ALL your addresses Your login token Your tracking ID Your device ID Cookies Which tokens you hold Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Uniswap Labs can stop you can swap the code you run writes into your tx Consensys · MM APIs can stop you can swap the code you run writes into your tx Consensys · SERVO relay can stop you can show you wrong numbers Blockaid can stop you can show you wrong numbers writes into your tx Consensys · Infura can stop you can get your funds stuck writes into your tx Etherscan can show you wrong numbers Datadog Segment even when you do nothing only if you opted in GitHub Google · Web Store can stop you can swap the code you run even when you do nothing Sentry even when you do nothing only if you opted in Builders · relays can stop you

← ALL MAPS

M4The MetaMask Swap

MetaMask's built-in Swap · ETH→mUSD. One MetaMask API computes the route, the minimum-out, AND the calldata you sign — then takes a 0.875% fee. The rest is the M1 wallet backbone.

⚗ lab run 20260824-222054-swap-metamask · mainnet tx 0x407247a9…196f ↗ · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Consensys · MM APIs Your IP address → Consensys · SERVO relay Your IP address → Blockaid Your IP address → Consensys · Infura Your IP address → Etherscan Your IP address → Segment Your IP address → Google · Web Store Your IP address → Sentry Your address → Consensys · MM APIs Your address → Consensys · SERVO relay Your address → Blockaid Your address → Consensys · Infura ALL your addresses → Consensys · MM APIs ALL your addresses → Consensys · Infura Your login token → Consensys · MM APIs Your login token → Consensys · SERVO relay Your tracking ID → Segment Cookies → Etherscan Which tokens you hold → Consensys · MM APIs Your balances → Consensys · MM APIs Who you're paying → Consensys · SERVO relay Who you're paying → Blockaid How much → Consensys · MM APIs How much → Consensys · SERVO relay The whole unsigned tx → Consensys · MM APIs The whole unsigned tx → Blockaid The whole unsigned tx → Consensys · Infura THE SIGNED TX → Consensys · SERVO relay THE SIGNED TX → Builders · relays The tx hash → Consensys · SERVO relay The tx hash → Consensys · Infura The tx hash → Etherscan Your IP address Your address ALL your addresses Your login token Your tracking ID Cookies Which tokens you hold Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Consensys · MM APIs can stop you can make you lose funds writes into your tx Consensys · SERVO relay can stop you can show you wrong numbers Blockaid can stop you can show you wrong numbers writes into your tx Consensys · Infura can stop you can get your funds stuck writes into your tx Etherscan can show you wrong numbers Segment even when you do nothing only if you opted in Google · Web Store can stop you can swap the code you run even when you do nothing Sentry even when you do nothing only if you opted in Builders · relays can stop you

← ALL MAPS

MTThe Token Send

MetaMask · send an ERC-20 token (mUSD). Same backbone as the ETH send, but the tx you sign goes to the TOKEN CONTRACT — your recipient is buried in calldata — and Blockaid scans the token too.

⚗ lab run 20260824-223756-send-token · mainnet tx 0xfda8cdbb…82cd ↗ · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Consensys · MM APIs Your IP address → Consensys · SERVO relay Your IP address → Blockaid Your IP address → Consensys · Infura Your IP address → Etherscan Your IP address → Segment Your IP address → Google · Web Store Your IP address → Sentry Your address → Consensys · MM APIs Your address → Consensys · SERVO relay Your address → Blockaid Your address → Consensys · Infura ALL your addresses → Consensys · MM APIs ALL your addresses → Consensys · Infura Your login token → Consensys · MM APIs Your login token → Consensys · SERVO relay Your tracking ID → Segment Cookies → Etherscan Which tokens you hold → Consensys · MM APIs Who you're paying → Consensys · SERVO relay Who you're paying → Blockaid How much → Consensys · SERVO relay The whole unsigned tx → Consensys · MM APIs The whole unsigned tx → Blockaid The whole unsigned tx → Consensys · Infura THE SIGNED TX → Consensys · SERVO relay THE SIGNED TX → Builders · relays The tx hash → Consensys · SERVO relay The tx hash → Consensys · Infura The tx hash → Etherscan Your IP address Your address ALL your addresses Your login token Your tracking ID Cookies Which tokens you hold Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Consensys · MM APIs can stop you can swap the code you run writes into your tx Consensys · SERVO relay can stop you can show you wrong numbers Blockaid can stop you can show you wrong numbers writes into your tx Consensys · Infura can stop you can get your funds stuck writes into your tx Etherscan can show you wrong numbers Segment even when you do nothing only if you opted in Google · Web Store can stop you can swap the code you run even when you do nothing Sentry even when you do nothing only if you opted in Builders · relays can stop you

← ALL MAPS

APThe Token Approval

MetaMask · swap a token back to ETH. The dangerous part isn't a transaction — it's a Permit2 SIGNATURE that grants the router permission to move your token. The signature that drains wallets.

⚗ lab run 20260825-094249-approve-swap · mainnet tx 0x0befcc21…ed48 ↗ · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Consensys · MM APIs Your IP address → Consensys · SERVO relay Your IP address → Blockaid Your IP address → Consensys · Infura Your IP address → Etherscan Your IP address → Segment Your IP address → Google · Web Store Your IP address → Sentry Your address → Consensys · MM APIs Your address → Consensys · SERVO relay Your address → Blockaid Your address → Consensys · Infura ALL your addresses → Consensys · MM APIs ALL your addresses → Consensys · Infura Your login token → Consensys · MM APIs Your login token → Consensys · SERVO relay Your tracking ID → Segment Cookies → Etherscan Which tokens you hold → Consensys · MM APIs Your balances → Consensys · MM APIs Who you're paying → Consensys · SERVO relay Who you're paying → Blockaid How much → Consensys · MM APIs How much → Consensys · SERVO relay The whole unsigned tx → Consensys · MM APIs The whole unsigned tx → Blockaid The whole unsigned tx → Consensys · Infura THE SIGNED TX → Consensys · SERVO relay THE SIGNED TX → Builders · relays The tx hash → Consensys · SERVO relay The tx hash → Consensys · Infura The tx hash → Etherscan Your IP address Your address ALL your addresses Your login token Your tracking ID Cookies Which tokens you hold Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Consensys · MM APIs can stop you can make you lose funds writes into your tx Consensys · SERVO relay can stop you can show you wrong numbers Blockaid can stop you can show you wrong numbers writes into your tx Consensys · Infura can stop you can get your funds stuck writes into your tx Etherscan can show you wrong numbers Segment even when you do nothing only if you opted in Google · Web Store can stop you can swap the code you run even when you do nothing Sentry even when you do nothing only if you opted in Builders · relays can stop you

← ALL MAPS

ONThe Fiat On-Ramp

MetaMask · Buy (fiat on-ramp). The entry to everything — and where you hand over the MOST. No signing here: it's all identity. You're geolocated, jurisdiction-gated, then handed to a KYC provider who takes your legal ID and bank.

⚗ lab run 20260825-124239-buy-metamask — capture-only — drove MetaMask's Buy to the aggregator surface and STOPPED; no purchase, no KYC, no payment ever entered · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Coinbase on-ramp Your IP address → MoonPay Your IP address → Consensys · MM APIs Your address → Coinbase on-ramp Your address → MoonPay Your IP address Your address Coinbase on-ramp can stop you can show you wrong numbers only if you click MoonPay can stop you can show you wrong numbers Consensys · MM APIs can stop you can show you wrong numbers

← ALL MAPS

BRThe L2 Bridge

MetaMask · bridge ETH from Ethereum to Base. Same closed engine as the swap, now cross-chain — and it stacks new trust: a bridge operator you can't see, plus Base's sequencer. The convenient path is NOT the escape hatch.

⚗ lab run 20260826-185312-bridge-metamask — dry — driven to the quoted Ethereum→Base bridge screen (ETH→ETH on Base), not broadcast · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Consensys · MM APIs Your IP address → Consensys · SERVO relay Your IP address → Blockaid Your IP address → Consensys · Infura Your IP address → Etherscan Your IP address → Segment Your IP address → Google · Web Store Your IP address → Sentry Your address → Consensys · MM APIs Your address → Consensys · SERVO relay Your address → Blockaid Your address → Consensys · Infura ALL your addresses → Consensys · MM APIs ALL your addresses → Consensys · Infura Your login token → Consensys · MM APIs Your login token → Consensys · SERVO relay Your tracking ID → Segment Cookies → Etherscan Which tokens you hold → Consensys · MM APIs Your balances → Consensys · MM APIs Who you're paying → Consensys · SERVO relay Who you're paying → Blockaid How much → Consensys · MM APIs How much → Consensys · SERVO relay The whole unsigned tx → Consensys · MM APIs The whole unsigned tx → Blockaid The whole unsigned tx → Consensys · Infura THE SIGNED TX → Consensys · SERVO relay THE SIGNED TX → Builders · relays The tx hash → Consensys · SERVO relay The tx hash → Consensys · Infura The tx hash → Etherscan Your IP address Your address ALL your addresses Your login token Your tracking ID Cookies Which tokens you hold Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Consensys · MM APIs can stop you can make you lose funds writes into your tx Consensys · SERVO relay can stop you can show you wrong numbers Blockaid can stop you can show you wrong numbers writes into your tx Consensys · Infura can stop you can get your funds stuck writes into your tx Etherscan can show you wrong numbers Segment even when you do nothing only if you opted in Google · Web Store can stop you can swap the code you run even when you do nothing Sentry even when you do nothing only if you opted in Builders · relays can stop you

← ALL MAPS

OFThe Fiat Off-Ramp

MetaMask · Sell (fiat off-ramp). The exit — and the mirror of the on-ramp. You hand over legal identity AND a bank account, then SIGN a public tx that ties your address to your KYC forever. Crypto leaves before fiat arrives, so the provider can freeze the payout.

⚗ lab run 20260901-140427-sell-metamask — PARTIAL live capture. Reached the off-ramp FRONT surface live: geolocation resolved the exit to region us-co, and MetaMask pulled the region-gated provider/payments catalog (~25KB). Key finding the code map missed: MetaMask's Buy/Sell is NOT in the extension — it opens a hosted web app in a NEW TAB (app.metamask.io/buy), carrying a persistent metametricsId in the URL, and loads third-party AD + analytics trackers (LinkedIn ad pixel, HubSpot CRM, Intercom, LaunchDarkly, Sentry) before you do anything. The Sell-specific legs (provider quote, MoonPay KYC + bank, the signed public exit tx, AML payout) were NOT reached — they sit behind a MetaMetrics/marketing-cookie consent wall and then KYC, which this capture-only run deliberately does not cross. Nothing signed, no KYC, no bank entered. · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → MoonPay Your IP address → Consensys · MM APIs Your IP address → LinkedIn Ads Your address → MoonPay Your address → Consensys · Infura Your balances → Consensys · MM APIs Who you're paying → Consensys · Infura How much → MoonPay How much → Consensys · Infura THE SIGNED TX → Consensys · Infura THE SIGNED TX → Builders · relays Your IP address Your address Your balances Who you're paying How much THE SIGNED TX MoonPay can stop you can make you lose funds Consensys · MM APIs can stop you can show you wrong numbers Consensys · Infura can stop you can get your funds stuck LinkedIn Ads Builders · relays can stop you

← ALL MAPS

RCThe Recovery

MetaMask · recover on a new device. The one good story on these maps: the recovery act is LOCAL — your phrase re-derives the key on-device, zero third parties. The catch: it works only if you kept the phrase, there is no recovery from loss and no inheritance, and every easier option hands the switch to Google, a guardian service, or a custodian.

⚗ lab run 20260831-213515-recover-metamask — live recovery capture — fresh device, re-imported the throwaway SRP under mitmproxy, then recorded the re-sync. 289 decrypted requests / 48 hosts. Nothing signed or sent. PROVES the seed stayed local: 0 seed bytes appeared in any request body. · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Consensys · MM APIs Your IP address → Consensys · Infura Your IP address → Google · Web Store Your address → Consensys · MM APIs Your address → Consensys · Infura ALL your addresses → Consensys · MM APIs Your login token → Consensys · MM APIs Your balances → Consensys · MM APIs Your IP address Your address ALL your addresses Your login token Your balances Consensys · MM APIs can show you wrong numbers even when you do nothing Consensys · Infura can stop you can show you wrong numbers Google · Web Store can stop you can swap the code you run

← ALL MAPS

RTThe Rabby Token Send

Rabby · send an ERC-20 (mUSD). Rabby's server picks and vouches for the token; the tx goes to the token contract, recipient buried in calldata.

⚗ lab run 20261002-100425-send-token-rabby — real send: 0.5 mUSD → austingriffith.eth · mainnet tx 0xf94d9569…cd58 ↗ · ⚗ lab run 20261002-095627-send-token-rabby — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE AWS CLOUDFRONT READS ALL OF THESE FIRST Your IP address → Rabby · DeBank API Your IP address → Hyperliquid Your IP address → Etherscan Your IP address → Google Analytics Your IP address → Sentry Your address → Rabby · DeBank API Your address → Hyperliquid ALL your addresses → Rabby · DeBank API Your device ID → Rabby · DeBank API Your device ID → Google Analytics Cookies → Etherscan Which dapp you're on → Rabby · DeBank API Who you're paying → Rabby · DeBank API How much → Rabby · DeBank API The whole unsigned tx → Rabby · DeBank API THE SIGNED TX → Rabby · DeBank API THE SIGNED TX → Builders · relays The tx hash → Rabby · DeBank API The tx hash → Etherscan Your IP address Your address ALL your addresses Your device ID Cookies Which dapp you're on Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Rabby · DeBank API can stop you can swap the code you run writes into your tx Hyperliquid can show you wrong numbers Etherscan can show you wrong numbers only if you click Google Analytics even when you do nothing Sentry even when you do nothing Builders · relays can stop you

← ALL MAPS

RBTThe Rainbow Token Send

Rainbow · send an ERC-20 (mUSD). Same path as its ETH send. No server checks the token; only its logo is fetched.

⚗ lab run 20261002-100525-send-token-rainbow — real send: 0.5 mUSD → austingriffith.eth · mainnet tx 0xb6634fca…9bf6 ↗ · ⚗ lab run 20261002-095337-send-token-rainbow — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Rainbow · RPC proxy Your IP address → Rainbow · APIs Your IP address → Etherscan Your IP address → RudderStack Your IP address → Google · Firebase Your IP address → Sentry Your IP address → Google · Web Store Your address → Rainbow · RPC proxy Your address → Rainbow · APIs Your device ID → RudderStack Your device ID → Google · Firebase Your device ID → Sentry Cookies → Etherscan Your balances → Rainbow · APIs Who you're paying → Rainbow · RPC proxy How much → Rainbow · RPC proxy How much → RudderStack The whole unsigned tx → Rainbow · RPC proxy THE SIGNED TX → Rainbow · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Rainbow · APIs The tx hash → Etherscan Your IP address Your address Your device ID Cookies Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Rainbow · RPC proxy can stop you can make you lose funds writes into your tx Rainbow · APIs can stop you can make you lose funds writes into your tx Etherscan can show you wrong numbers only if you click RudderStack Google · Firebase can stop you can swap the code you run even when you do nothing Sentry even when you do nothing Google · Web Store can stop you can swap the code you run even when you do nothing Builders · relays can stop you

← ALL MAPS

RSThe Rabby Swap

Rabby's built-in Swap · ETH→USDC. Rabby's server shops the aggregators (1inch won), hands back the bytes you sign, takes 0.25%, and gets the trade record after.

⚗ lab run 20261002-101515-swap-rabby — real swap: 0.0005 ETH → 1.360864 USDC via 1inch · mainnet tx 0x735ee6e1…9b0c ↗ · ⚗ lab run 20261002-101144-swap-rabby — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE AWS CLOUDFRONT READS ALL OF THESE FIRST Your IP address → Rabby · DeBank API Your IP address → Hyperliquid Your IP address → Etherscan Your IP address → Google Analytics Your IP address → Sentry Your address → Rabby · DeBank API Your address → Hyperliquid ALL your addresses → Rabby · DeBank API Your device ID → Rabby · DeBank API Your device ID → Google Analytics Cookies → Etherscan Which dapp you're on → Rabby · DeBank API Who you're paying → Rabby · DeBank API How much → Rabby · DeBank API The whole unsigned tx → Rabby · DeBank API THE SIGNED TX → Rabby · DeBank API THE SIGNED TX → Builders · relays The tx hash → Rabby · DeBank API The tx hash → Etherscan Your IP address Your address ALL your addresses Your device ID Cookies Which dapp you're on Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Rabby · DeBank API can stop you can make you lose funds writes into your tx Hyperliquid can show you wrong numbers Etherscan can show you wrong numbers only if you click Google Analytics even when you do nothing Sentry even when you do nothing Builders · relays can stop you

← ALL MAPS

RBSThe Rainbow Swap

Rainbow's built-in Swap · ETH→USDC. Rainbow's server picks the route (Sprinter) and the bytes you sign — and the swap quietly turned the account into a smart wallet (EIP-7702, Uniswap's Calibur).

⚗ lab run 20261002-101605-swap-rainbow — real swap: 0.0005 ETH → 1.377901 USDC via Sprinter · mainnet tx 0xa030ca73…29f2 ↗ · ⚗ lab run 20261002-101234-swap-rainbow — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Rainbow · RPC proxy Your IP address → Rainbow · APIs Your IP address → Etherscan Your IP address → RudderStack Your IP address → Google · Firebase Your IP address → Sentry Your IP address → Google · Web Store Your address → Rainbow · RPC proxy Your address → Rainbow · APIs Your device ID → RudderStack Your device ID → Google · Firebase Your device ID → Sentry Cookies → Etherscan Who you're paying → Rainbow · RPC proxy How much → Rainbow · RPC proxy How much → Rainbow · APIs How much → RudderStack The whole unsigned tx → Rainbow · RPC proxy THE SIGNED TX → Rainbow · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Rainbow · APIs The tx hash → Etherscan Your IP address Your address Your device ID Cookies Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Rainbow · RPC proxy can stop you can make you lose funds writes into your tx Rainbow · APIs can stop you can swap the code you run writes into your tx Etherscan can show you wrong numbers only if you click RudderStack Google · Firebase can stop you can swap the code you run even when you do nothing Sentry even when you do nothing Google · Web Store can stop you can swap the code you run even when you do nothing Builders · relays can stop you

← ALL MAPS

RAPThe Rabby Token Approval

Rabby · sell 1 USDC. Two signed txs: an exact 1-USDC approve, then the swap. The quote and the contract you approve both come from Rabby's server.

⚗ lab run 20261002-102645-approve-swap-rabby — approve 1 USDC, then swap tx 0x2528dff0b595867d4506d9102d52acc7b55b6be8a6f3e7b2fe4fe2d5e5353ab5 · mainnet tx 0x56ce0e03…be06 ↗ · ⚗ lab run 20261002-102320-approve-swap-rabby — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE AWS CLOUDFRONT READS ALL OF THESE FIRST Your IP address → Rabby · DeBank API Your IP address → Hyperliquid Your IP address → Etherscan Your IP address → Google Analytics Your IP address → Sentry Your address → Rabby · DeBank API Your address → Hyperliquid ALL your addresses → Rabby · DeBank API Your device ID → Rabby · DeBank API Your device ID → Google Analytics Cookies → Etherscan Which dapp you're on → Rabby · DeBank API Who you're paying → Rabby · DeBank API How much → Rabby · DeBank API The whole unsigned tx → Rabby · DeBank API THE SIGNED TX → Rabby · DeBank API THE SIGNED TX → Builders · relays The tx hash → Rabby · DeBank API The tx hash → Etherscan Your IP address Your address ALL your addresses Your device ID Cookies Which dapp you're on Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Rabby · DeBank API can stop you can make you lose funds writes into your tx Hyperliquid can show you wrong numbers Etherscan can show you wrong numbers only if you click Google Analytics even when you do nothing Sentry even when you do nothing Builders · relays can stop you

← ALL MAPS

RBAThe Rainbow Token Approval

Rainbow · sell 1 USDC. The smart account bundles the approve and the swap into one tx — you never see the approval as its own step.

⚗ lab run 20261002-102735-approve-swap-rainbow — approve + swap batched in one tx · mainnet tx 0x0a70ffcd…1b83 ↗ · ⚗ lab run 20261002-102410-approve-swap-rainbow — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Rainbow · RPC proxy Your IP address → Rainbow · APIs Your IP address → Etherscan Your IP address → RudderStack Your IP address → Google · Firebase Your IP address → Sentry Your IP address → Google · Web Store Your address → Rainbow · RPC proxy Your address → Rainbow · APIs Your device ID → RudderStack Your device ID → Google · Firebase Your device ID → Sentry Cookies → Etherscan Who you're paying → Rainbow · RPC proxy How much → Rainbow · RPC proxy How much → Rainbow · APIs How much → RudderStack The whole unsigned tx → Rainbow · RPC proxy THE SIGNED TX → Rainbow · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Rainbow · APIs The tx hash → Etherscan Your IP address Your address Your device ID Cookies Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Rainbow · RPC proxy can stop you can make you lose funds writes into your tx Rainbow · APIs can stop you can make you lose funds writes into your tx Etherscan can show you wrong numbers only if you click RudderStack Google · Firebase can stop you can swap the code you run even when you do nothing Sentry even when you do nothing Google · Web Store can stop you can swap the code you run even when you do nothing Builders · relays can stop you

← ALL MAPS

CB1The Coinbase Wallet Send

Coinbase Wallet · plain ETH send. One company answers everything — and the wallet quietly signs a login to Coinbase with your key.

⚗ lab run 20261002-111719-send-eth-coinbase — real send: 0.0002 ETH → 0x34aa…fdf3 · mainnet tx 0x66e61bb9…4c3d ↗ · ⚗ lab run 20261002-110308-send-eth-coinbase — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Coinbase · wallet APIs Your IP address → Coinbase · RPC proxy Your address → Coinbase · wallet APIs Your address → Coinbase · RPC proxy ALL your addresses → Coinbase · wallet APIs Your login token → Coinbase · wallet APIs Your balances → Coinbase · wallet APIs Who you're paying → Coinbase · wallet APIs Who you're paying → Coinbase · RPC proxy How much → Coinbase · RPC proxy The whole unsigned tx → Coinbase · RPC proxy THE SIGNED TX → Coinbase · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Coinbase · RPC proxy Your IP address Your address ALL your addresses Your login token Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Coinbase · wallet APIs can stop you can get your funds stuck writes into your tx Coinbase · RPC proxy can stop you can get your funds stuck writes into your tx Builders · relays can stop you

← ALL MAPS

PH1The Phantom Send

Phantom · plain ETH send. A server-side Phantom account behind a self-custody wallet: it screens you, simulates your tx, and uploads who you paid.

⚗ lab run 20261002-110730-send-eth-phantom — real send: 0.0002 ETH → 0x34aa…fdf3 · mainnet tx 0xbd62c7bc…ef7f ↗ · ⚗ lab run 20261002-110348-send-eth-phantom — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Phantom · APIs Your IP address → Phantom · RPC proxy Your IP address → Phantom · analytics Your address → Phantom · APIs Your address → Phantom · RPC proxy ALL your addresses → Phantom · APIs ALL your addresses → Phantom · RPC proxy Your login token → Phantom · APIs Your device ID → Phantom · analytics Your balances → Phantom · APIs Who you're paying → Phantom · APIs Who you're paying → Phantom · RPC proxy How much → Phantom · APIs How much → Phantom · RPC proxy The whole unsigned tx → Phantom · APIs The whole unsigned tx → Phantom · RPC proxy THE SIGNED TX → Phantom · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Phantom · RPC proxy Your IP address Your address ALL your addresses Your login token Your device ID Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Phantom · APIs can stop you can get your funds stuck writes into your tx Phantom · RPC proxy can stop you can get your funds stuck writes into your tx Phantom · analytics even when you do nothing Builders · relays can stop you

← ALL MAPS

CBTThe Coinbase Wallet Token Send

Coinbase Wallet · send an ERC-20 (mUSD). Same path as its ETH send; no request vouches for the token.

⚗ lab run 20261002-113706-send-token-coinbase — real send: 0.3 mUSD → 0x34aa…fdf3 · mainnet tx 0x3ba6aa88…4286 ↗ · ⚗ lab run 20261002-112301-send-token-coinbase — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Coinbase · wallet APIs Your IP address → Coinbase · RPC proxy Your address → Coinbase · wallet APIs Your address → Coinbase · RPC proxy ALL your addresses → Coinbase · wallet APIs Your login token → Coinbase · wallet APIs Your balances → Coinbase · wallet APIs Who you're paying → Coinbase · wallet APIs Who you're paying → Coinbase · RPC proxy How much → Coinbase · RPC proxy The whole unsigned tx → Coinbase · RPC proxy THE SIGNED TX → Coinbase · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Coinbase · RPC proxy Your IP address Your address ALL your addresses Your login token Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Coinbase · wallet APIs can stop you can get your funds stuck writes into your tx Coinbase · RPC proxy can stop you can get your funds stuck writes into your tx Builders · relays can stop you

← ALL MAPS

PHTThe Phantom Token Send

Phantom · send an ERC-20 (mUSD). Same path as its ETH send; no request vouches for the token.

⚗ lab run 20261002-113932-send-token-phantom — real send: 0.3 mUSD → 0x34aa…fdf3 · mainnet tx 0xd857bbaf…6e4a ↗ · ⚗ lab run 20261002-112016-send-token-phantom — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Phantom · APIs Your IP address → Phantom · RPC proxy Your IP address → Phantom · analytics Your address → Phantom · APIs Your address → Phantom · RPC proxy ALL your addresses → Phantom · APIs ALL your addresses → Phantom · RPC proxy Your login token → Phantom · APIs Your device ID → Phantom · analytics Your balances → Phantom · APIs Who you're paying → Phantom · APIs Who you're paying → Phantom · RPC proxy How much → Phantom · APIs How much → Phantom · RPC proxy The whole unsigned tx → Phantom · APIs The whole unsigned tx → Phantom · RPC proxy THE SIGNED TX → Phantom · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Phantom · RPC proxy Your IP address Your address ALL your addresses Your login token Your device ID Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Phantom · APIs can stop you can get your funds stuck writes into your tx Phantom · RPC proxy can stop you can get your funds stuck writes into your tx Phantom · analytics even when you do nothing Builders · relays can stop you

← ALL MAPS

CBSThe Coinbase Wallet Swap

Coinbase Wallet's built-in Swap · ETH→USDC. Coinbase's server picks among 28 sources and hands back the bytes you sign.

⚗ lab run 20261002-114212-swap-coinbase — real swap: 0.0005 ETH → USDC · mainnet tx 0xf0b16da5…fdc7 ↗ · ⚗ lab run 20261002-112609-swap-coinbase — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Coinbase · wallet APIs Your IP address → Coinbase · RPC proxy Your address → Coinbase · wallet APIs Your address → Coinbase · RPC proxy ALL your addresses → Coinbase · wallet APIs Your balances → Coinbase · wallet APIs Who you're paying → Coinbase · wallet APIs Who you're paying → Coinbase · RPC proxy How much → Coinbase · wallet APIs How much → Coinbase · RPC proxy The whole unsigned tx → Coinbase · RPC proxy THE SIGNED TX → Coinbase · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Coinbase · RPC proxy Your IP address Your address ALL your addresses Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Coinbase · wallet APIs can stop you can make you lose funds writes into your tx Coinbase · RPC proxy can stop you can get your funds stuck writes into your tx Builders · relays can stop you

← ALL MAPS

CBAThe Coinbase Wallet Token Approval

Coinbase Wallet · sell 0.5 USDC. The screen never mentions an approval, yet two txs go out: an exact 0.5-USDC approve, then the swap.

⚗ lab run 20261002-120032-approve-swap-coinbase — approve exactly 0.5 USDC, then swap tx 0xddc862f3a344d85288a8319a80d9a70594192a85e0fb96a09869b5c0b66374f7 · mainnet tx 0xf6e6db78…3109 ↗ · ⚗ lab run 20261002-115835-approve-swap-coinbase — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Coinbase · wallet APIs Your IP address → Coinbase · RPC proxy Your address → Coinbase · wallet APIs Your address → Coinbase · RPC proxy ALL your addresses → Coinbase · wallet APIs Your balances → Coinbase · wallet APIs Who you're paying → Coinbase · wallet APIs Who you're paying → Coinbase · RPC proxy How much → Coinbase · wallet APIs How much → Coinbase · RPC proxy The whole unsigned tx → Coinbase · RPC proxy THE SIGNED TX → Coinbase · RPC proxy THE SIGNED TX → Builders · relays The tx hash → Coinbase · RPC proxy Your IP address Your address ALL your addresses Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Coinbase · wallet APIs can stop you can make you lose funds writes into your tx Coinbase · RPC proxy can stop you can get your funds stuck writes into your tx Builders · relays can stop you

← ALL MAPS

PHSThe Phantom Swap

Phantom's built-in Swap · ETH→USDC. It sends every address you own on every chain, quotes 4.9% slippage, takes 0.85%, and broadcasts through its own submission service.

⚗ lab run 20261002-114440-swap-phantom — real swap: 0.0005 ETH → USDC via DexRouter · mainnet tx 0xf51e4db3…3bb9 ↗ · ⚗ lab run 20261002-113457-swap-phantom — dry: stopped at the confirm screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Phantom · APIs Your IP address → Phantom · RPC proxy Your IP address → Phantom · analytics Your address → Phantom · APIs Your address → Phantom · RPC proxy ALL your addresses → Phantom · APIs ALL your addresses → Phantom · RPC proxy Your login token → Phantom · APIs Your device ID → Phantom · analytics Your balances → Phantom · APIs Who you're paying → Phantom · APIs Who you're paying → Phantom · RPC proxy How much → Phantom · APIs How much → Phantom · RPC proxy The whole unsigned tx → Phantom · APIs The whole unsigned tx → Phantom · RPC proxy THE SIGNED TX → Phantom · APIs THE SIGNED TX → Builders · relays The tx hash → Phantom · RPC proxy Your IP address Your address ALL your addresses Your login token Your device ID Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Phantom · APIs can stop you can make you lose funds writes into your tx Phantom · RPC proxy can stop you can get your funds stuck writes into your tx Phantom · analytics even when you do nothing Builders · relays can stop you

← ALL MAPS

PHAThe Phantom Token Approval

Phantom · sell 0.5 USDC. It approved UNLIMITED USDC to a contract named TokenApprove — the only wallet of four that did.

⚗ lab run 20261002-115244-approve-swap-phantom — approve UNLIMITED USDC, then swap tx 0x1711ba3f67a6345edf6ce73713e825bdf87c81e5bbf8cbc8c511a92e349a13f8 · mainnet tx 0xb6d77203…b1a0 ↗ · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Phantom · APIs Your IP address → Phantom · RPC proxy Your IP address → Phantom · analytics Your address → Phantom · APIs Your address → Phantom · RPC proxy ALL your addresses → Phantom · APIs ALL your addresses → Phantom · RPC proxy Your login token → Phantom · APIs Your device ID → Phantom · analytics Your balances → Phantom · APIs Who you're paying → Phantom · APIs Who you're paying → Phantom · RPC proxy How much → Phantom · APIs How much → Phantom · RPC proxy The whole unsigned tx → Phantom · APIs The whole unsigned tx → Phantom · RPC proxy THE SIGNED TX → Phantom · APIs THE SIGNED TX → Builders · relays The tx hash → Phantom · RPC proxy Your IP address Your address ALL your addresses Your login token Your device ID Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Phantom · APIs can stop you can make you lose funds writes into your tx Phantom · RPC proxy can stop you can get your funds stuck writes into your tx Phantom · analytics even when you do nothing Builders · relays can stop you

← ALL MAPS

FR1The Frame Send

Frame (desktop) · plain ETH send. The fewest third parties of any wallet: one company's RPC, a send app loaded from ENS over IPFS, signed locally. Unmaintained since early 2025.

⚗ lab run 20261002-193627-send-eth-frame — real send: 0.0002 ETH → austingriffith.eth via send.frame.eth · mainnet tx 0x9b2302a6…7f0f ↗ · ⚗ lab run 20261002-131104-send-eth-frame — dry: stopped at Frame's sign screen · route JSON

I run my own Ethereum node

Where your data goes

YOUR MACHINE CLOUDFLARE EDGE READS ALL OF THESE FIRST Your IP address → Frame · Pylon/Nebula Your IP address → GitHub Your address → Frame · Pylon/Nebula ALL your addresses → Frame · Pylon/Nebula Your balances → Frame · Pylon/Nebula Who you're paying → Frame · Pylon/Nebula How much → Frame · Pylon/Nebula The whole unsigned tx → Frame · Pylon/Nebula THE SIGNED TX → Frame · Pylon/Nebula THE SIGNED TX → Builders · relays The tx hash → Frame · Pylon/Nebula Your IP address Your address ALL your addresses Your balances Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Frame · Pylon/Nebula can stop you can swap the code you run writes into your tx GitHub can swap the code you run even when you do nothing Builders · relays can stop you

← ALL MAPS

NNight Service

Runs whenever MetaMask is unlocked. No send required.

⚗ lab run 20260821-193024-send-eth — the background traffic recorded during the M1 capture

I run my own Ethereum node

← ALL MAPS

Where's the leverage?

Every flow's leak, summed across all 31 mapped journeys — five ways to look at the same data, to open the conversation about what's worth attacking first. Weight = how many of the 31 flows carry that data to that place, not raw request count. One honest caveat: 11 of the 31 journeys ride MetaMask, so "reach" partly reflects what we've mapped so far — treat the counts as an initial signal, weight later by real transaction volume.

1 · What leaks widest

Which of your data reaches the most different companies. Your IP is the tell — it rides almost everything.

Your IP address48 companies · 31 flows

Your address28 companies · 30 flows

How much18 companies · 28 flows

Who you're paying14 companies · 28 flows

The whole unsigned tx13 companies · 27 flows

THE SIGNED TX11 companies · 28 flows

The tx hash11 companies · 27 flows

Your device ID9 companies · 14 flows

ALL your addresses8 companies · 23 flows

Your balances7 companies · 17 flows

Swap token pair (tokenIn/tokenOut)7 companies · 13 flows

Your login token4 companies · 15 flows

The name you typed3 companies · 1 flow

Cookies2 companies · 17 flows

Which tokens you hold2 companies · 9 flows

Legal identity (KYC + bank)2 companies · 2 flows

Signed userOp (4337)2 companies · 1 flow

Your tracking ID1 company · 8 flows

Which dapp you're on1 company · 4 flows

Swap route + quote (path, amountOut, minOut, Universal Router calldata)1 company · 1 flow

2 · How much has no escape

Split all that leaked data by whether a self-sovereign alternative exists today. This is the buildability gap — the red slice is what has to be built from scratch.

Only 18% of what leaves your machine has a self-sovereign escape today. 82% does not — and 25% has no alternative at all.

25%NO ESCAPE

57%ESCAPE IS PAINFUL

18%SELF-RUN EXISTS

3 · Attack priority — reach × harm

Reach alone isn't the whole story. Here every gadget type is placed by how wide it reaches (→) against how much active harm it can do if it turns evil (↑ block you, lie to you, rewrite your tx). Bubble = number of companies; color = escape (none / painful / exists). Top-right is where the damage and the reach overlap. Surveillance isn't on this axis — analytics sits low here yet collects the most; that's what chart 1 measures.

ATTACK FIRST → lower priority REACH — how many of 31 flows → ↑ HARM — block · lie · writes your tx RPC — chain reads · 29/31 flows · harm 5 · 9 companies Wallet backend · 28/31 flows · harm 5 · 7 companies Wallet / code dist. · 16/31 flows · harm 4 · 2 companies Tx broadcast / relay · 14/31 flows · harm 4 · 4 companies Tx / address screening · 12/31 flows · harm 4 · 3 companies Indexer — balances · 9/31 flows · harm 5 · 6 companies Block builders · 29/31 flows · harm 1 · 1 companies Prices & market data · 6/31 flows · harm 4 · 3 companies Block explorer · 17/31 flows · harm 1 · 2 companies Name resolution (ENS) · 2/31 flows · harm 5 · 2 companies Hosted dApp frontend · 2/31 flows · harm 5 · 3 companies Fiat on/off-ramp · 2/31 flows · harm 4 · 2 companies Tx simulation · 4/31 flows · harm 2 · 1 companies ERC-4337 bundler · 1/31 flows · harm 5 · 1 companies Analytics / telemetry · 21/31 flows · harm 0 · 9 companies Avatars & images · 1/31 flows · harm 0 · 1 companies RPC — chain reads 29·h5 Wallet backend 28·h5 Indexer — balances 9·h5 Name resolution (ENS) 2·h5 Hosted dApp frontend 2·h5 ERC-4337 bundler 1·h5 Wallet / code dist. 16·h4 Tx broadcast / relay 14·h4 Tx / address screening 12·h4 Prices & market data 6·h4 Fiat on/off-ramp 2·h4 Tx simulation 4·h2 Block builders 29·h1 Block explorer 17·h1 Analytics / telemetry 21·h0 Avatars & images 1·h0

4 · By gadget type — the flows

The actual data ribbons, actors folded into categories (Infura = Alchemy = RPC), sorted by reach. Box border = escape: red = none, amber = painful, green = exists. See the Gadget Shelf for the fix + cost.

YOUR DATA WHICH GADGET GETS IT Your IP address → rpc · 28 flows Your IP address → wallet-backend · 28 flows Your IP address → analytics · 21 flows Your IP address → verification-explorer · 17 flows Your IP address → code-distribution · 16 flows Your IP address → relay-broadcast · 14 flows Your IP address → screening · 12 flows Your IP address → indexer · 9 flows Your IP address → price-oracle · 6 flows Your IP address → simulation · 4 flows Your IP address → frontend · 2 flows Your IP address → on-ramp · 2 flows Your IP address → name-resolution · 2 flows Your IP address → bundler · 1 flow Your IP address → media · 1 flow Your address → rpc · 25 flows Your address → wallet-backend · 20 flows Your address → analytics · 1 flow Your address → verification-explorer · 1 flow Your address → relay-broadcast · 13 flows Your address → screening · 12 flows Your address → indexer · 9 flows Your address → simulation · 4 flows Your address → frontend · 1 flow Your address → on-ramp · 2 flows Your address → name-resolution · 1 flow Your address → bundler · 1 flow ALL your addresses → rpc · 13 flows ALL your addresses → wallet-backend · 17 flows ALL your addresses → relay-broadcast · 1 flow ALL your addresses → screening · 4 flows Your login token → wallet-backend · 15 flows Your login token → relay-broadcast · 8 flows Your tracking ID → analytics · 8 flows Your device ID → rpc · 5 flows Your device ID → wallet-backend · 8 flows Your device ID → analytics · 13 flows Your device ID → relay-broadcast · 4 flows Your device ID → screening · 4 flows Your device ID → indexer · 4 flows Your device ID → price-oracle · 4 flows Your device ID → simulation · 4 flows Your device ID → frontend · 1 flow Cookies → verification-explorer · 17 flows Which tokens you hold → wallet-backend · 8 flows Which tokens you hold → price-oracle · 1 flow Your balances → rpc · 2 flows Your balances → wallet-backend · 13 flows Your balances → indexer · 1 flow Your balances → frontend · 1 flow Which dapp you're on → rpc · 4 flows Which dapp you're on → relay-broadcast · 4 flows Which dapp you're on → simulation · 4 flows The name you typed → rpc · 1 flow The name you typed → name-resolution · 1 flow The name you typed → media · 1 flow Who you're paying → rpc · 16 flows Who you're paying → wallet-backend · 8 flows Who you're paying → relay-broadcast · 13 flows Who you're paying → screening · 12 flows Who you're paying → bundler · 1 flow How much → rpc · 16 flows How much → wallet-backend · 11 flows How much → analytics · 4 flows How much → relay-broadcast · 13 flows How much → indexer · 2 flows How much → frontend · 1 flow How much → on-ramp · 1 flow How much → bundler · 1 flow The whole unsigned tx → rpc · 27 flows The whole unsigned tx → wallet-backend · 12 flows The whole unsigned tx → relay-broadcast · 5 flows The whole unsigned tx → screening · 8 flows The whole unsigned tx → simulation · 4 flows The whole unsigned tx → bundler · 1 flow THE SIGNED TX → rpc · 13 flows THE SIGNED TX → builder · 28 flows THE SIGNED TX → wallet-backend · 2 flows THE SIGNED TX → relay-broadcast · 13 flows THE SIGNED TX → simulation · 4 flows The tx hash → rpc · 22 flows The tx hash → verification-explorer · 16 flows The tx hash → relay-broadcast · 8 flows The tx hash → indexer · 4 flows The tx hash → frontend · 1 flow The tx hash → bundler · 1 flow Your IP address Your address ALL your addresses Your login token Your tracking ID Your device ID Cookies Which tokens you hold Your balances Which dapp you're on The name you typed Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash RPC — chain reads 29/31 · 9co Block builders 29/31 · 1co Wallet backend 28/31 · 7co Analytics / telemetry 21/31 · 9co Block explorer 17/31 · 2co Wallet / code dist. 16/31 · 2co Tx broadcast / relay 14/31 · 4co Tx / address screening 12/31 · 3co Indexer — balances 9/31 · 6co Prices & market data 6/31 · 3co Tx simulation 4/31 · 1co Hosted dApp frontend 2/31 · 3co Fiat on/off-ramp 2/31 · 2co Name resolution (ENS) 2/31 · 2co ERC-4337 bundler 1/31 · 1co Avatars & images 1/31 · 1co

5 · By company — who specifically

The same leaks, named — the 16 widest-reaching of the 49 companies that receive something. "The node provider" is one throat — but it's a different company per wallet.

YOUR DATA WHICH COMPANY GETS IT Your IP address → etherscan · 16 flows Your IP address → sentry · 16 flows Your IP address → google · 14 flows Your IP address → consensys-apis · 11 flows Your IP address → infura · 9 flows Your IP address → servo · 8 flows Your IP address → blockaid · 8 flows Your IP address → segment · 8 flows Your IP address → rabby · 4 flows Your IP address → phantom-apis · 4 flows Your IP address → phantom-rpc · 4 flows Your IP address → coinbase-rpc · 4 flows Your IP address → coinbase-wallet · 4 flows Your IP address → rainbow-rpc · 4 flows Your IP address → rainbow-apis · 4 flows Your address → consensys-apis · 9 flows Your address → infura · 10 flows Your address → servo · 8 flows Your address → blockaid · 8 flows Your address → rabby · 4 flows Your address → phantom-apis · 4 flows Your address → phantom-rpc · 4 flows Your address → coinbase-rpc · 4 flows Your address → coinbase-wallet · 4 flows Your address → rainbow-rpc · 4 flows Your address → rainbow-apis · 4 flows ALL your addresses → consensys-apis · 9 flows ALL your addresses → infura · 8 flows ALL your addresses → rabby · 4 flows ALL your addresses → phantom-apis · 4 flows ALL your addresses → phantom-rpc · 4 flows ALL your addresses → coinbase-wallet · 4 flows Your login token → consensys-apis · 9 flows Your login token → servo · 8 flows Your login token → phantom-apis · 4 flows Your login token → coinbase-wallet · 2 flows Your tracking ID → segment · 8 flows Your device ID → sentry · 4 flows Your device ID → rabby · 4 flows Cookies → etherscan · 16 flows Which tokens you hold → consensys-apis · 8 flows Your balances → consensys-apis · 5 flows Your balances → phantom-apis · 4 flows Your balances → coinbase-wallet · 4 flows Your balances → rainbow-apis · 1 flow Which dapp you're on → rabby · 4 flows The name you typed → infura · 1 flow Who you're paying → infura · 1 flow Who you're paying → servo · 8 flows Who you're paying → blockaid · 8 flows Who you're paying → rabby · 4 flows Who you're paying → phantom-apis · 4 flows Who you're paying → phantom-rpc · 4 flows Who you're paying → coinbase-rpc · 4 flows Who you're paying → coinbase-wallet · 4 flows Who you're paying → rainbow-rpc · 4 flows How much → consensys-apis · 3 flows How much → infura · 1 flow How much → servo · 8 flows How much → rabby · 4 flows How much → phantom-apis · 4 flows How much → phantom-rpc · 4 flows How much → coinbase-rpc · 4 flows How much → coinbase-wallet · 2 flows How much → rainbow-rpc · 4 flows How much → rainbow-apis · 2 flows The whole unsigned tx → consensys-apis · 8 flows The whole unsigned tx → infura · 8 flows The whole unsigned tx → blockaid · 8 flows The whole unsigned tx → rabby · 4 flows The whole unsigned tx → phantom-apis · 4 flows The whole unsigned tx → phantom-rpc · 4 flows The whole unsigned tx → coinbase-rpc · 4 flows The whole unsigned tx → rainbow-rpc · 4 flows THE SIGNED TX → builders · 28 flows THE SIGNED TX → infura · 1 flow THE SIGNED TX → servo · 8 flows THE SIGNED TX → rabby · 4 flows THE SIGNED TX → phantom-apis · 2 flows THE SIGNED TX → phantom-rpc · 2 flows THE SIGNED TX → coinbase-rpc · 4 flows THE SIGNED TX → rainbow-rpc · 4 flows The tx hash → etherscan · 16 flows The tx hash → infura · 8 flows The tx hash → servo · 8 flows The tx hash → rabby · 4 flows The tx hash → phantom-rpc · 4 flows The tx hash → coinbase-rpc · 4 flows The tx hash → rainbow-apis · 4 flows Your IP address Your address ALL your addresses Your login token Your tracking ID Your device ID Cookies Which tokens you hold Your balances Which dapp you're on The name you typed Who you're paying How much The whole unsigned tx THE SIGNED TX The tx hash Builders · relays 29/31 Etherscan 16/31 Sentry 16/31 Google · Web Store 14/31 Consensys · MM APIs 11/31 Consensys · Infura 10/31 Consensys · SERVO relay 8/31 Blockaid 8/31 Segment 8/31 Rabby · DeBank API 4/31 Phantom · APIs 4/31 Phantom · RPC proxy 4/31 Coinbase · RPC proxy 4/31 Coinbase · wallet APIs 4/31 Rainbow · RPC proxy 4/31 Rainbow · APIs 4/31

6 · What the CROPS version looks like

For each gadget, the move that creates the self-sovereign counterfactual. Once the counterfactual exists, every hosted version has to explain why it doesn't work that way. Sorted by leverage: no escape first, widest reach first.

Wallet backend TURN IT OFF28/31 flows

Ship flags and defaults signed in the release; pull updates as signed public lists anyone can mirror — no per-user queries. What breaks: the vendor's instant kill-switch and A/B tests. Not your sends.

Hosted dApp frontend BUILD THE EXAMPLE2/31 flows

Pin the frontend to IPFS/ENS. The test is binary: does the dApp work with nothing hosted?

Fiat on/off-ramp OPEN PROBLEM2/31 flows

No self-sovereign fiat rail exists; peer-to-peer is the only escape and it's thin. The open problem.

ERC-4337 bundler RUN A REPLACEMENT1/31 flows

Self-bundle: wrap your own UserOp and submit it through your node.

TLS edge / CDN OPEN PROBLEMfronts the rest

Falls away only when what's behind it (frontends, backends) becomes self-hostable.

RPC — chain reads BUILD THE EXAMPLE29/31 flows

A wallet that ships with a light client (Helios) — reads verified against consensus, not trusted. Full escape stays your own node.

Block builders SET A STANDARD29/31 flows

Protocol-level: forced-inclusion lists (FOCIL) so no builder can keep a tx out.

Block explorer BUILD THE EXAMPLE17/31 flows

Otterscan on your own node today; 'your own etherscan' is an AI-buildable afternoon.

Wallet / code dist. SET A STANDARD16/31 flows

Reproducible builds signed by the team, verifiable outside the store.

Tx broadcast / relay BUILD THE EXAMPLE14/31 flows

Wallet-native p2p broadcast: hand the signed tx to the public mempool from your own machine.

Indexer — balances RUN A REPLACEMENT9/31 flows

Local indexing derived from your own node, behind the same wallet UI.

Prices & market data RUN A REPLACEMENT6/31 flows

Read prices onchain (DEX TWAPs) — or go without fiat values.

Analytics / telemetry TURN IT OFF21/31 flows

Nothing to build. Default it to off.

Tx / address screening SET A STANDARD12/31 flows

A signed public risk-list any wallet pulls and checks locally — no server sees the query.

Tx simulation ALREADY EXISTS4/31 flows

Local simulation against your own node works today — make it the default.

Name resolution (ENS) ALREADY EXISTS2/31 flows

Your node already resolves ENS with one eth_call.

Avatars & images TURN IT OFF1/31 flows

Skip it, or fetch onchain art through your node.

← ALL MAPS

!Top Gaps

The categories from Access Vectors you can't route around today (NONE), plus RPC (PAINFUL), taken one at a time. Who holds each position, what it sees, what it can do, what you can do now, and what would have to exist. Counts come from the route data (a stop shared by several maps counts once per map); the own-node lines come from lab runs with the RPC set in each wallet (Your Own Node).

1

TLS edge / CDN zero option: NONE 451 stops on 30 of 31 maps · 74% live-observed

Who holds it: Cloudflare edge (331), AWS CloudFront (120)

What it sees: Signed raw tx, Full unsigned tx, All account addresses, Selected address, Recipient address, Amount, Balances + positions

What it can do: block 178 of these stops, 111 of them with no setting to turn off; give 72 answers where a lie costs funds or ships code; link your IP to your addresses over time.

What you can do today: Unavoidable when using any hosted service. With your own node set in the wallet: 17 of 99 tested stops in this category moved off it; 82 still went to it.

What would have to exist: Falls away only when what's behind it (frontends, backends) becomes self-hostable. Fixes that retire the most of these stops: Private RPC access (86); Local or verifiable indexing (75); Verifiable RPC reads (60).

2

Wallet's own backend (flags, config, prices) zero option: NONE 291 stops on 28 of 31 maps · 75% live-observed

Who holds it: Consensys · MM APIs (114), Rabby · DeBank API (87), Coinbase · wallet APIs (46), Phantom · APIs (34), Google · Firebase (8), WalletConnect (1), Ambire · monitor (1)

What it sees: Signed raw tx, Full unsigned tx, All account addresses, Selected address, Recipient address, Amount, Balances + positions

What it can do: block 95 of these stops, 71 of them with no setting to turn off; give 35 answers where a lie costs funds or ships code; link your IP to your addresses over time.

What you can do today: Use a wallet that has no phone-home backend. With your own node set in the wallet: 2 of 68 tested stops in this category moved off it; 66 still went to it.

What would have to exist: Ship flags and defaults signed in the release; pull updates as signed public lists anyone can mirror — no per-user queries. What breaks: the vendor's instant kill-switch and A/B tests. Not your sends. Fixes that retire the most of these stops: Local or verifiable indexing (50); Local address-risk checks (31); Independently hosted frontends (25).

3

Hosted dApp frontend zero option: NONE 14 stops on 2 of 31 maps · 50% live-observed

Who holds it: Uniswap Labs (12), Avara · app.aave.com (1), Family (1)

What it sees: Selected address, Amount, Balances + positions, Tx hash, Swap route + quote (path, amountOut, minOut, Universal Router calldata), Swap token pair (tokenIn/tokenOut), IP address

What it can do: block 9 of these stops, 9 of them with no setting to turn off; give 3 answers where a lie costs funds or ships code; link your IP to your addresses over time.

What you can do today: Sometimes: self-host the UI or call the contract directly — often NOT possible. With your own node set in the wallet: 0 of 6 tested stops in this category moved off it; 6 still went to it.

What would have to exist: Pin the frontend to IPFS/ENS. The test is binary: does the dApp work with nothing hosted? Fixes that retire the most of these stops: Independently hosted frontends (2); Local or verifiable indexing (2); Verifiable RPC reads (1).

4

RPC — chain reads & writes zero option: PAINFUL 123 stops on 25 of 31 maps · 85% live-observed

Who holds it: Consensys · Infura (44), Rainbow · RPC proxy (28), Coinbase · RPC proxy (16), Phantom · RPC proxy (14), Reth · public RPC (9), Frame · Pylon/Nebula (7), Ambire · invictus RPC (4), Alchemy (1)

What it sees: Signed raw tx, Full unsigned tx, All account addresses, Selected address, Recipient address, Amount, Balances + positions

What it can do: block 77 of these stops, 23 of them with no setting to turn off; give 41 answers where a lie costs funds or ships code; link your IP to your addresses over time.

What you can do today: Run your own full node and point the wallet at it. Cost: Sync + run a full node — disk, time, upkeep. With your own node set in the wallet: 35 of 37 tested stops in this category moved off it; 2 still went to it.

What would have to exist: A wallet that ships with a light client (Helios) — reads verified against consensus, not trusted. Full escape stays your own node. Fixes that retire the most of these stops: Private RPC access (101); Verifiable RPC reads (63); Censorship-resistant broadcast (11).

← ALL MAPS

◉Your Own Node

Each wallet with Ethereum pointed at a node on your own network, set in the wallet's own settings, then run in the lab. Green went to your node; red still left your machine; grey didn't come up in the run. Across these maps your node answered 38 of 153 tested requests (25%). The rest go to the same companies as before.

PW

Plain Wallet Send 100% of tested requests8 to your node · 0 still out · 4 not tested · real send ↗ · ⚗ lab run

Nothing else seen.

RB1

Rainbow Send 45% of tested requests5 to your node · 6 still out · 11 not tested · +2 hosts no stop covers · real send ↗ · ⚗ lab run

Rainbow's platform API still gets your address, balances and tx list. A node elsewhere on your LAN is blocked by the extension; it has to run on the same computer.

M1

Normie Send 38% of tested requests6 to your node · 10 still out · 2 stopped · 10 not tested · +25 hosts no stop covers · real send ↗ · ⚗ lab run · ⚗ lab run

Blockaid gets the full unsigned tx 4 s before you sign; MetaMask's simulation gets it too.

M2

ENS Send 31% of tested requests4 to your node · 9 still out · 17 not tested · +25 hosts no stop covers · dry run · ⚗ lab run

Name resolution moves to your node; Blockaid and MetaMask's simulation still get the tx.

MT

Token Send 21% of tested requests3 to your node · 11 still out · 14 not tested · +26 hosts no stop covers · dry run · ⚗ lab run

Blockaid scans the token and gets the full tx.

AP

Token Approval 17% of tested requests2 to your node · 10 still out · 17 not tested · +25 hosts no stop covers · dry run · ⚗ lab run

The quote and the calldata you sign come from MetaMask's engine.

M4

MetaMask Swap 15% of tested requests2 to your node · 11 still out · 16 not tested · +24 hosts no stop covers · dry run · ⚗ lab run

The swap route and the calldata you sign come from MetaMask's engine (bridge.api.cx.metamask.io).

BR

L2 Bridge 15% of tested requests2 to your node · 11 still out · 16 not tested · +24 hosts no stop covers · dry run · ⚗ lab run

Base-side reads still go to Infura. A mainnet node doesn't cover the L2.

R1

Rabby Send 14% of tested requests2 to your node · 12 still out · 1 stopped · 11 not tested · real send ↗ · ⚗ lab run · ⚗ lab run

Rabby polls the receipt with your tx hash seconds after you send, and its pre_exec_tx gets the full unsigned tx.

U1

Uniswap Swap 13% of tested requests2 to your node · 13 still out · 26 not tested · +42 hosts no stop covers · dry run · ⚗ lab run

Uniswap reads the chain through its own gateway (unirpc).

M3

Aave Deposit 11% of tested requests2 to your node · 17 still out · 22 not tested · +37 hosts no stop covers · dry run · ⚗ lab run

Aave's app reads the chain through its own server (app.aave.com/api/rpc-proxy). Your wallet's node never sees the dapp's reads.

ON

Fiat On-Ramp 0% of tested requests0 to your node · 2 still out · 2 not tested · +58 hosts no stop covers · dry run · ⚗ lab run

MetaMask geolocates you and gates providers by region. Your node got 4 of MetaMask's background reads, none of them stops on this map.

OF

Fiat Off-Ramp 0% of tested requests0 to your node · 3 still out · 5 not tested · +56 hosts no stop covers · dry run · ⚗ lab run

MetaMask geolocates you and gates providers by region; the provider page hits Infura with its own key. Your node got 4 of MetaMask's background reads, none of them stops on this map.

← ALL MAPS

What's proven

Correctness is the moat: before this map names who leaks, every claim has to be checkable. Here is what's backed by a live capture and what still isn't. Computed from the route data.

The evidence

69% of every data-exposure claim on these maps is backed by a live packet capture. The rest is traced from source code or inferred — and still needs a capture to confirm.

69%LIVE-OBSERVED

28%CODE-TRACED

Still to validate — 16 actors, no live capture yet

Traced from source or inferred, not yet seen on the wire. The queue for the next captures.

Etherscan CODE-TRACED48 claims

verify-a-tx is click-gated — not triggered by the automated send capture

Builders · relays INFERRED29 claims

block builders / relays — inferred from protocol; every tx passes them

Pimlico bundler CODE-TRACED13 claims

ERC-4337 bundler — smart-account infra, traced from code not a wallet call

Ambire · relayer CODE-TRACED12 claims

Ambire smart account can't onboard in the VM (needs a live relayer to derive its address) — the inability is itself the finding

Ambire · invictus RPC CODE-TRACED11 claims

same Ambire onboarding blocker

DeBank CODE-TRACED3 claims

capture pending

Ambire · cena CODE-TRACED3 claims

same Ambire onboarding blocker

CCIP gateway INFERRED2 claims

CCIP-read offchain resolver — only fires for names that use it

Avatar host INFERRED2 claims

ENS avatar image host — cosmetic, not exercised in the captured send

Ethereum p2p REFERENCE2 claims

the Mountain Man's own broadcast — a constructed reference flow

Amplitude CODE-TRACED2 claims

analytics — fires to an ingest subdomain the capture didn't decode

ENS metadata CODE-TRACED2 claims

ENS metadata/avatar service — not hit by a plain resolve

The Graph CODE-TRACED2 claims

indexer path — traced from code

Avara · app.aave.com CODE-TRACED1 claim

Aave app API — captured run exists (m3); these rows are code-traced

Family CODE-TRACED1 claim

Family/Rainbow name service — traced from code

Ambire · monitor CODE-TRACED1 claim

same Ambire onboarding blocker

Proven live — 33 actors

Seen in a mitmproxy capture; most on a real mainnet transaction. Links go to the lab run and the tx.

Uniswap Labs 16 LIVE16 observed · 15 code

⚗ uniswap

← ALL MAPS

≡Access Vectors

Every actor generalized to a category (Infura and Alchemy are both just "RPC"), ranked by prevalence — how many flows it sits on — and exposure — what it can do to you. The right column is the zero option: is there a fully self-sovereign fallback, and what does the Mountain Man do instead? None = top priority; painful = still worth fixing; local = the escape hatch already exists. Prevalence is an initial signal, not the final sort — weight later by real transaction volume. Computed from the route data.

1

TLS edge / CDN AWS CloudFront, Cloudflare edge

On 31 flows AB1APBRCB1CBACBSCBTFR1M1M2M3M4MTNOFONPH1PHAPHSPHTPWR1RAPRB1RBARBSRBTRCRSRTU1 · can: can block (no setting removes it) · malicious code · links identity over time

zero option: NONE — no self-sovereign option · Mountain Man: Unavoidable when using any hosted service

Cloudflare/CloudFront front nearly everything. They can block by jurisdiction and terminate TLS. No self-sovereign option while using hosted services.

2

Block builders & relays Builders · relays

On 29 flows AB1APBRCB1CBACBSCBTFR1M0M1M2M3M4MTOFPH1PHAPHSPHTPWR1RAPRB1RBARBSRBTRSRTU1 · can: can block (no setting removes it)

zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Wait for a non-censoring local/among builder to include you

On EVERY flow. Can censor today in principle; the fix is Fossil / forced inclusion. Binary-ish: does a censorship-resistant path exist.

3

Wallet's own backend (flags, config, prices) Ambire · monitor, Coinbase · wallet APIs, Consensys · MM APIs, Google · Firebase, LaunchDarkly, Phantom · APIs, Rabby · DeBank API, Statsig, WalletConnect

On 26 flows AB1APBRCB1CBACBSCBTM1M2M3M4MTNOFONPH1PHAPHSPHTR1RAPRB1RCRSRTU1 · can: can block (no setting removes it) · malicious code · links identity over time

zero option: NONE — no self-sovereign option · Mountain Man: Use a wallet that has no phone-home backend

Feature flags, remote config, and defaults served from the wallet vendor. Proprietary; no self-sovereign version short of a different wallet.

4

RPC — chain reads & writes Alchemy, Ambire · invictus RPC, Coinbase · RPC proxy, Consensys · Infura, Frame · Pylon/Nebula, Phantom · RPC proxy, Rainbow · RPC proxy, Reth · public RPC

On 26 flows AB1APBRCB1CBACBSCBTFR1M1M2M3M4MTNOFPH1PHAPHSPHTPWRB1RBARBSRBTRCU1 · can: can block (no setting removes it) · malicious code · links identity over time

zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Run your own full node and point the wallet at it

The single most prevalent dependency. Sees every read and takes your broadcast. A node is the fallback but costs sync time, disk, and upkeep.

5

Block explorer (verify a tx completed) DeBank, Etherscan

On 17 flows APBRM1M2M3M4MTPWR1RAPRB1RBARBSRBTRSRTU1 · can: false belief · links identity over time

zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Check against your own node / run your own explorer

Etherscan is a UNIVERSAL trust assumption — every user, even Mountain Men, sanity-checks a tx on Etherscan. A node confirms it, but people still trust the explorer's UI.

6

Analytics & crash telemetry Amplitude, Datadog, Google Analytics, HubSpot, Intercom, LinkedIn Ads, Phantom · analytics, RudderStack, Segment, Sentry

On 10 flows M3NOFPH1R1RB1RBARBSRBTU1 · can: can block · links identity over time

zero option: LOCAL — self-sovereign version exists · Mountain Man: Send nothing

Segment/Sentry/Amplitude/etc. Removable by a toggle or by using a wallet that doesn't phone home. The Mountain Man sends none.

7

Indexer — balances, history, token lists ACI · aavechan, Hyperliquid, Merkl, Rainbow · APIs, The Graph

On 9 flows M3R1RAPRB1RBARBSRBTRSRT · can: can block (no setting removes it) · malicious code

zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Run your own indexer / derive it from your node

The 'what do I own / what happened' layer. Self-indexing is possible but heavy; most wallets have no local option.

8

Transaction broadcast / relay Ambire · relayer, Consensys · SERVO relay

On 9 flows AB1APBRM1M2M3M4MTU1 · can: can block (no setting removes it) · funds stuck · links identity over time

zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Broadcast straight to your own node / the public mempool

Private relays (Smart Transactions) and bundlers sit between you and inclusion. Direct broadcast is the fallback but loses MEV protection and can be slow.

9

Wallet / code distribution GitHub, Google · Web Store

On 8 flows AB1FR1M3NPWRB1RCU1 · can: can block (no setting removes it) · malicious code

zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Build the wallet from source and side-load it

The Web Store / GitHub that ships (and can silently update) the wallet code. Building from source avoids the auto-update trust but is painful.

10

Address / tx security screening Blockaid, Compliance vendor

On 8 flows APBRM1M2M3M4MTU1 · can: can block (no setting removes it) · funds stuck

zero option: LOCAL — self-sovereign version exists · Mountain Man: Skip it, or run local address-risk checks

A downloadable blocklist or local check can replace the server call; the Mountain Man often just doesn't use it.

11

Prices & market data Ambire · cena, CoinGecko

On 3 flows AB1FR1M3 · can: can block · false belief

zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Run your own price feed, or go without fiat values

Fiat valuations and swap pricing. Degrades gracefully without it; a self-sovereign feed is possible but rarely done.

12

Hosted dApp frontend Avara · app.aave.com, Family, Uniswap Labs

On 2 flows M3U1 · can: can block (no setting removes it) · malicious code · links identity over time

zero option: NONE — no self-sovereign option · Mountain Man: Sometimes: self-host the UI or call the contract directly — often NOT possible

THE hard gap. If a dApp's frontend depends on its own backend, you can't use it without them. Safe can be self-hosted; many can't. No zero option in the general case.

13

Fiat on-ramp / off-ramp Coinbase on-ramp, MoonPay

On 2 flows OFON · can: can block (no setting removes it) · funds lost

zero option: NONE — no self-sovereign option · Mountain Man: Already hold crypto — earn it, get paid in it, or acquire peer-to-peer

The funnel entry. No private fiat rail exists: geolocation + jurisdiction gate + full KYC. The only zero option is to skip fiat entirely.

14

Name resolution (ENS) CCIP gateway, ENS metadata

On 2 flows M2M3 · can: can block (no setting removes it) · funds lost

zero option: LOCAL — self-sovereign version exists · Mountain Man: Resolve on-chain via your own node (eth_call)

ENS resolves on-chain; a node does it with no extra party. Metadata/avatar services are optional cosmetics.

15

ERC-4337 bundler / paymaster Pimlico bundler

On 1 flow AB1 · can: can block (no setting removes it) · funds lost

zero option: NONE — no self-sovereign option · Mountain Man: N/A — an EOA avoids it entirely

Smart-account infra. A 4337 account cannot even onboard or transact without a live bundler/paymaster (see Ambire). No offline option.

16

Avatars & token images Avatar host

On 1 flow M2 · can: sees your data

zero option: LOCAL — self-sovereign version exists · Mountain Man: Skip them

Cosmetic only. Leaks IP + address for a picture; trivially skippable.

← ALL MAPS

⚙The Mountain Man's Gadget Shelf

The clean Mountain Man map hides his real UX. Every gadget the centralized flows outsource to a company (a leak you can see), the Mountain Man must run himself — at a cost the map never shows — or it's simply missing (no self-sovereign option today). This is that hidden shelf: per gadget, who the centralized flows use, what the Mountain Man does instead and what it costs, and whether you could build your own now with AI. The MISSING rows are the real gaps; the buildable now ones are where the cost is already dropping. Computed from the route data.

1

TLS edge / CDN MISSING not buildable yet

Centralized flows use: AWS CloudFront, Cloudflare edge AB1APBRCB1CBACBSCBTFR1M1M2M3M4MTNOFONPH1PHAPHSPHTPWR1RAPRB1RBARBSRBTRCRSRTU1 · outsourced on 31 flows

Mountain Man: Unavoidable while using any hosted service

Cloudflare/CloudFront front nearly everything. They can block by jurisdiction and terminate TLS. No self-sovereign option while using hosted services.

2

Wallet's own backend (flags, config, prices) MISSING not buildable yet

Centralized flows use: Ambire · monitor, Coinbase · wallet APIs, Consensys · MM APIs, Google · Firebase, LaunchDarkly, Phantom · APIs, Rabby · DeBank API, Statsig, WalletConnect AB1APBRCB1CBACBSCBTM1M2M3M4MTNOFONPH1PHAPHSPHTR1RAPRB1RCRSRTU1 · outsourced on 26 flows

Mountain Man: Use a wallet with no phone-home backend

Feature flags, remote config, and defaults served from the wallet vendor. Proprietary; no self-sovereign version short of a different wallet.

3

Hosted dApp frontend MISSING partly buildable

Centralized flows use: Avara · app.aave.com, Family, Uniswap Labs M3U1 · outsourced on 2 flows

Mountain Man: Self-host the UI or call the contract raw — often impossible

THE hard gap. If a dApp's frontend depends on its own backend, you can't use it without them. Safe can be self-hosted; many can't. No zero option in the general case.

4

Fiat on-ramp / off-ramp MISSING not buildable yet

Centralized flows use: Coinbase on-ramp, MoonPay OFON · outsourced on 2 flows

Mountain Man: No private fiat rail — earn it, get paid in it, or go P2P

The funnel entry. No private fiat rail exists: geolocation + jurisdiction gate + full KYC. The only zero option is to skip fiat entirely.

5

ERC-4337 bundler / paymaster MISSING not buildable yet

Centralized flows use: Pimlico bundler AB1 · outsourced on 1 flow

Mountain Man: N/A — an EOA avoids it entirely

Smart-account infra. A 4337 account cannot even onboard or transact without a live bundler/paymaster (see Ambire). No offline option.

6

Block builders & relays SELF-RUN (costly) not buildable yet

Centralized flows use: Builders · relays AB1APBRCB1CBACBSCBTFR1M0M1M2M3M4MTOFPH1PHAPHSPHTPWR1RAPRB1RBARBSRBTRSRTU1 · outsourced on 29 flows

Mountain Man: Wait for a non-censoring builder (Fossil fixes this)

On EVERY flow. Can censor today in principle; the fix is Fossil / forced inclusion. Binary-ish: does a censorship-resistant path exist.

7

RPC — chain reads & writes SELF-RUN (costly) partly buildable

Centralized flows use: Alchemy, Ambire · invictus RPC, Coinbase · RPC proxy, Consensys · Infura, Frame · Pylon/Nebula, Phantom · RPC proxy, Rainbow · RPC proxy, Reth · public RPC AB1APBRCB1CBACBSCBTFR1M1M2M3M4MTNOFPH1PHAPHSPHTPWRB1RBARBSRBTRCU1 · outsourced on 26 flows

Mountain Man: Sync + run a full node — disk, time, upkeep

The single most prevalent dependency. Sees every read and takes your broadcast. A node is the fallback but costs sync time, disk, and upkeep.

8

Block explorer (verify a tx completed) SELF-RUN (costly) buildable now

Centralized flows use: DeBank, Etherscan APBRM1M2M3M4MTPWR1RAPRB1RBARBSRBTRSRTU1 · outsourced on 17 flows

Mountain Man: Run your own explorer (Otterscan) — or build one with AI

Etherscan is a UNIVERSAL trust assumption — every user, even Mountain Men, sanity-checks a tx on Etherscan. A node confirms it, but people still trust the explorer's UI.

9

Indexer — balances, history, token lists SELF-RUN (costly) buildable now

Centralized flows use: ACI · aavechan, Hyperliquid, Merkl, Rainbow · APIs, The Graph M3R1RAPRB1RBARBSRBTRSRT · outsourced on 9 flows

Mountain Man: Run your own indexer over your node

The 'what do I own / what happened' layer. Self-indexing is possible but heavy; most wallets have no local option.

10

Transaction broadcast / relay SELF-RUN (costly) partly buildable

Centralized flows use: Ambire · relayer, Consensys · SERVO relay AB1APBRM1M2M3M4MTU1 · outsourced on 9 flows

Mountain Man: Broadcast to your own node / the public mempool

Private relays (Smart Transactions) and bundlers sit between you and inclusion. Direct broadcast is the fallback but loses MEV protection and can be slow.

11

Wallet / code distribution SELF-RUN (costly) partly buildable

Centralized flows use: GitHub, Google · Web Store AB1FR1M3NPWRB1RCU1 · outsourced on 8 flows

Mountain Man: Build the wallet from source and side-load it

The Web Store / GitHub that ships (and can silently update) the wallet code. Building from source avoids the auto-update trust but is painful.

12

Prices & market data SELF-RUN (costly) buildable now

Centralized flows use: Ambire · cena, CoinGecko AB1FR1M3 · outsourced on 3 flows

Mountain Man: Run your own price feed, or go without fiat values

Fiat valuations and swap pricing. Degrades gracefully without it; a self-sovereign feed is possible but rarely done.

13

Analytics & crash telemetry SELF-RUN buildable now

Centralized flows use: Amplitude, Datadog, Google Analytics, HubSpot, Intercom, LinkedIn Ads, Phantom · analytics, RudderStack, Segment, Sentry M3NOFPH1R1RB1RBARBSRBTU1 · outsourced on 10 flows

Mountain Man: Send nothing

Segment/Sentry/Amplitude/etc. Removable by a toggle or by using a wallet that doesn't phone home. The Mountain Man sends none.

14

Address / tx security screening SELF-RUN buildable now

Centralized flows use: Blockaid, Compliance vendor APBRM1M2M3M4MTU1 · outsourced on 8 flows

Mountain Man: Local blocklist, or skip it

A downloadable blocklist or local check can replace the server call; the Mountain Man often just doesn't use it.

15

Name resolution (ENS) SELF-RUN buildable now

Centralized flows use: CCIP gateway, ENS metadata M2M3 · outsourced on 2 flows

Mountain Man: Resolve on-chain via your own node

ENS resolves on-chain; a node does it with no extra party. Metadata/avatar services are optional cosmetics.

16

Avatars & token images SELF-RUN buildable now

Centralized flows use: Avatar host M2 · outsourced on 1 flow

Mountain Man: Skip the images

Cosmetic only. Leaks IP + address for a picture; trivially skippable.

17

Transaction simulation SELF-RUN buildable now

Centralized flows use: — · outsourced on 0 flows

Mountain Man: Run a simulator against your own node

Blockaid-style pre-sign simulation. A local version is feasible today — MetaMask required Blockaid to also ship an obfuscated local build. Good-enough local sim exists.

← ALL MAPS

★Interchanges

Every actor on 2+ maps, or where a lie costs funds or code, or with a block no setting removes. CROPS scored 0–3 per axis, 0 worst: Censorship-Resistance (can they block?) · Open-source · Privacy (what they collect) · Security (what a lie costs). Computed from the route data, not hand-ranked.

1

Builders · relays (4337 EntryPoint · builder network)

Serves AB1APBRCB1CBACBSCBTFR1M0M1M2M3M4MTOFPH1PHAPHSPHTPWR1RAPRB1RBARBSRBTRSRTU1 · receives · CROPS CR0 · O1 · P2 · S3 · can block, no escape

2

Cloudflare edge TLS terminates here for every fronted API call

Serves AB1APBRCB1CBACBSCBTFR1M1M2M3M4MTNOFONPH1PHAPHSPHTPWRB1RBARBSRBTRCU1 · receives · CROPS CR0 · O0 · P0 · S0 · a lie ⇒ malicious code · can block, no escape · can link identity over time

3

Etherscan etherscan.io

Serves APBRM1M2M3M4MTR1RAPRB1RBARBSRBTRSRTU1 · receives · CROPS CR3 · O0 · P0 · S2 · a lie ⇒ false belief · can link identity over time

4

Consensys MM APIs + Infura + SERVO relay

Serves APBRM1M2M3M4MTNOFONRCU1 · receives · CROPS CR0 · O0 · P0 · S0 · a lie ⇒ malicious code · can block, no escape · can link identity over time

5

AWS CloudFront CDN + bucket for static files, and the TLS terminator for api.rabby.io (CloudFront → custom origin)

Serves NR1RAPRB1RBARBSRBTRSRT · receives · CROPS CR0 · O0 · P0 · S0 · a lie ⇒ malicious code · can block, no escape · can link identity over time

6

Blockaid security-alerts.api.cx.metamask.io/address/evm/scan

Serves APBRM1M2M3M4MTU1 · receives · CROPS CR2 · O0 · P1 · S2 · a lie ⇒ false belief

7

Coinbase wallet APIs + RPC proxy + Coinbase on-ramp

Serves CB1CBACBSCBTON · receives · CROPS CR0 · O0 · P0 · S0 · a lie ⇒ funds lost · can block, no escape · can link identity over time

8

DeBank DeBank + Rabby · DeBank API

Serves PWR1RAPRSRT · receives · CROPS CR0 · O0 · P0 · S0 · a lie ⇒ malicious code · can block, no escape · can link identity over time

9

Alphabet Google · Web Store + Google Analytics + Google · Firebase

Serves AB1NR1RB1RC · receives · CROPS CR0 · O0 · P0 · S0 · a lie ⇒ malicious code · can block, no escape · can link identity over time

10

Microsoft GitHub + LinkedIn Ads

Serves FR1M3OFPWU1 · receives · CROPS CR3 · O0 · P1 · S0 · a lie ⇒ malicious code

11

Sentry o331974.ingest.sentry.io

Serves M3NOFR1RB1 · receives · CROPS CR2 · O1 · P0 · S3 · can link identity over time

12

Phantom APIs + analytics + RPC proxy

Serves PH1PHAPHSPHT · receives · CROPS CR0 · O0 · P0 · S0 · a lie ⇒ funds lost · can block, no escape · can link identity over time

13

Rainbow APIs + RPC proxy

Serves RB1RBARBSRBT · receives · CROPS CR0 · O0 · P1 · S0 · a lie ⇒ malicious code · can block, no escape

14

Hyperliquid api.hyperliquid.xyz

Serves R1RAPRSRT · receives · CROPS CR3 · O0 · P1 · S2 · a lie ⇒ false belief

15

RudderStack rainbowjiumask.dataplane.rudderstack.com

Serves RB1RBARBSRBT · receives · CROPS CR3 · O1 · P0 · S3 · can link identity over time

16

MoonPay api.moonpay.com

Serves OFON · receives · CROPS CR0 · O0 · P1 · S0 · a lie ⇒ funds lost · can block, no escape

17

Amplitude api2.amplitude.com

Serves M3U1 · receives · CROPS CR2 · O0 · P0 · S3 · can link identity over time

18

CoinGecko app.aave.com/api/coingecko-categories

Serves FR1M3 · receives · CROPS CR2 · O0 · P1 · S3

19

Frame · Pylon/Nebula assets.coingecko.com · proxy.pylon.link

Serves FR1 · receives · CROPS CR0 · O1 · P0 · S0 · a lie ⇒ malicious code · can block, no escape · can link identity over time

20

Uniswap Labs app.uniswap.org

Serves U1 · receives · CROPS CR0 · O1 · P0 · S0 · a lie ⇒ malicious code · can block, no escape · can link identity over time

21

Avara · app.aave.com app.aave.com

Serves M3 · receives · CROPS CR0 · O1 · P1 · S0 · a lie ⇒ malicious code · can block, no escape

22

Pimlico bundler api.pimlico.io

Serves AB1 · receives · CROPS CR0 · O? · P1 · S0 · a lie ⇒ funds lost · can block, no escape

23

Statsig Feature-flag + A/B backend behind Uniswap's same-origin /config proxy (gating.interface.gateway.uniswap.org)

Serves U1 · receives · CROPS CR2 · O0 · P1 · S0 · a lie ⇒ malicious code

24

CCIP gateway (gateway URL chosen by the name issuer)

Serves M2 · receives · CROPS CR0 · O? · P1 · S0 · a lie ⇒ funds lost · can block, no escape

25

Ambire relayer + invictus RPC + cena + monitor

Serves AB1 · receives · CROPS CR0 · O0 · P0 · S1 · a lie ⇒ funds stuck · can block, no escape · can link identity over time

26

Reth · public RPC ethereum.reth.rs

Serves PW · receives · CROPS CR1 · O1 · P0 · S1 · a lie ⇒ funds stuck · can link identity over time

27

Compliance vendor app.aave.com/api/preflight-compliance → vendor unknown

Serves M3 · receives · CROPS CR0 · O0 · P1 · S1 · a lie ⇒ funds stuck · can block, no escape

28

Alchemy app.aave.com/api/rpc-proxy → eth-mainnet.g.alchemy.com

Serves M3 · receives · CROPS CR0 · O0 · P1 · S2 · a lie ⇒ false belief · can block, no escape

← ALL MAPS

▲Fixes

The interventions from the working list, ranked by what each retires across the maps: requests, funds-level lies, blocks no setting removes, answers that shape what you sign. Computed from the route data, not hand-ranked.

1

Private RPC access

Reads and broadcasts that don't tie your IP to your addresses.

Retires 44 requests across 30 maps · 17 where a lie costs funds or code · 9 blocks no setting removes · 19 that shape what you sign · 44 that carry identity AB1APBRCB1CBACBSCBTFR1M1M2M3M4MTNOFPH1PHAPHSPHTPWR1RAPRB1RBARBSRBTRCRSRTU1

2

Verifiable RPC reads

Light-client or proof-backed reads: the answer can be checked, so the RPC can't lie about state.

Retires 39 requests across 22 maps · 16 where a lie costs funds or code · 5 blocks no setting removes · 17 that shape what you sign · 39 that carry identity AB1APBRFR1M1M2M3M4MTNOFPWR1RAPRB1RBARBSRBTRCRSRTU1

3

Independently hosted frontends

App and wallet code built and served outside one store, CDN, or remote flag service.

Retires 22 requests across 10 maps · 11 where a lie costs funds or code · 10 blocks no setting removes · 3 that shape what you sign · 22 that carry identity AB1M3M4NOFONPWR1RB1U1

4

Open simulation

Run the tx preview yourself instead of trusting a closed simulator's answer.

Retires 14 requests across 21 maps · 10 where a lie costs funds or code · 9 blocks no setting removes · 14 that shape what you sign · 14 that carry identity AB1APBRCBACBSM1M2M3M4MTPH1PHAPHSPHTR1RAPRBARBSRSRTU1

5

Censorship-resistant broadcast

A path to inclusion that no single relay, RPC, or builder set can filter.

Retires 24 requests across 29 maps · 4 where a lie costs funds or code · 16 blocks no setting removes · 5 that shape what you sign · 14 that carry identity AB1APBRCB1CBACBSCBTFR1M0M1M2M3M4MTOFPH1PHAPHSPHTPWR1RAPRB1RBARBSRBTRSRTU1

6

Portable clear-signing data

Open metadata that lets the wallet say locally what calldata does.

Retires 6 requests across 9 maps · 3 where a lie costs funds or code · 2 blocks no setting removes · 3 that shape what you sign · 6 that carry identity APM3NOFR1RAPRSRTU1

7

Local or verifiable indexing

Balances, history, and positions from your own or provable index, not a closed API fed all your addresses.

Retires 28 requests across 28 maps · 1 block no setting removes · 1 that shape what you sign · 28 that carry identity AB1APBRCB1CBACBSCBTFR1M1M2M3M4MTNPH1PHAPHSPHTPWR1RAPRB1RBARBSRBTRSRTU1

8

Local address-risk checks

Phishing, sanctions, and scam screening against open local data — not a vendor that sees every recipient pre-sign.

Retires 11 requests across 16 maps · 8 that shape what you sign · 11 that carry identity AB1APBRCB1CBTM1M2M3M4MTNR1RAPRSRTU1

76 third-party requests match no fix on this list — mostly prices, APRs, analytics, and avatars.

← ALL MAPS

iStation Index

CodeStationReceivesPowersSkip this station by…CROPS