He owns every step against his own node — but "clean" hides the cost. HIS SHELF (below) shows the gadgets he must self-run to match the centralized players (green, with cost) and the ones that are simply MISSING (red). The self-run map was lying by omission.
Same send as M1, in Rainbow (1.6.11) · mainnet · defaults · address pasted in. One vendor owns the RPC, the balances and the confirmation; nothing is simulated or screened.
The same send, in Ambire (6.18.7) · mainnet · defaults · address pasted in. Not an EOA tx — a 4337 UserOperation: Ambire's relayer co-signs it as paymaster, Pimlico bundles it, and every hop terminates at Cloudflare.
MetaMask's built-in Swap · ETH→mUSD. One MetaMask API computes the route, the minimum-out, AND the calldata you sign — then takes a 0.875% fee. The rest is the M1 wallet backbone.
MetaMask · send an ERC-20 token (mUSD). Same backbone as the ETH send, but the tx you sign goes to the TOKEN CONTRACT — your recipient is buried in calldata — and Blockaid scans the token too.
MetaMask · swap a token back to ETH. The dangerous part isn't a transaction — it's a Permit2 SIGNATURE that grants the router permission to move your token. The signature that drains wallets.
MetaMask · Buy (fiat on-ramp). The entry to everything — and where you hand over the MOST. No signing here: it's all identity. You're geolocated, jurisdiction-gated, then handed to a KYC provider who takes your legal ID and bank.
⚗ lab run 20260825-124239-buy-metamask— capture-only — drove MetaMask's Buy to the aggregator surface and STOPPED; no purchase, no KYC, no payment ever entered · route JSON
MetaMask · bridge ETH from Ethereum to Base. Same closed engine as the swap, now cross-chain — and it stacks new trust: a bridge operator you can't see, plus Base's sequencer. The convenient path is NOT the escape hatch.
MetaMask · Sell (fiat off-ramp). The exit — and the mirror of the on-ramp. You hand over legal identity AND a bank account, then SIGN a public tx that ties your address to your KYC forever. Crypto leaves before fiat arrives, so the provider can freeze the payout.
⚗ lab run 20260901-140427-sell-metamask— PARTIAL live capture. Reached the off-ramp FRONT surface live: geolocation resolved the exit to region us-co, and MetaMask pulled the region-gated provider/payments catalog (~25KB). Key finding the code map missed: MetaMask's Buy/Sell is NOT in the extension — it opens a hosted web app in a NEW TAB (app.metamask.io/buy), carrying a persistent metametricsId in the URL, and loads third-party AD + analytics trackers (LinkedIn ad pixel, HubSpot CRM, Intercom, LaunchDarkly, Sentry) before you do anything. The Sell-specific legs (provider quote, MoonPay KYC + bank, the signed public exit tx, AML payout) were NOT reached — they sit behind a MetaMetrics/marketing-cookie consent wall and then KYC, which this capture-only run deliberately does not cross. Nothing signed, no KYC, no bank entered. · route JSON
MetaMask · recover on a new device. The one good story on these maps: the recovery act is LOCAL — your phrase re-derives the key on-device, zero third parties. The catch: it works only if you kept the phrase, there is no recovery from loss and no inheritance, and every easier option hands the switch to Google, a guardian service, or a custodian.
⚗ lab run 20260831-213515-recover-metamask— live recovery capture — fresh device, re-imported the throwaway SRP under mitmproxy, then recorded the re-sync. 289 decrypted requests / 48 hosts. Nothing signed or sent. PROVES the seed stayed local: 0 seed bytes appeared in any request body. · route JSON
Every flow's leak, summed across all 16 mapped journeys — five ways to look at the same data, to open the conversation about what's worth attacking first. Weight = how many of the 16 flows carry that data to that place, not raw request count. One honest caveat: 11 of the 16 journeys ride MetaMask, so "reach" partly reflects what we've mapped so far — treat the counts as an initial signal, weight later by real transaction volume.
1 · What leaks widest
Which of your data reaches the most different companies. Your IP is the tell — it rides almost everything.
Split all that leaked data by whether a self-sovereign alternative exists today. This is the buildability gap — the red slice is what has to be built from scratch.
Only 19% of what leaves your machine has a self-sovereign escape today. 81% does not — and 24% has no alternative at all.
24%NO ESCAPE
57%ESCAPE IS PAINFUL
19%SELF-RUN EXISTS
3 · Attack priority — reach × harm
Reach alone isn't the whole story. Here every gadget type is placed by how wide it reaches (→) against how much active harm it can do if it turns evil (↑ block you, lie to you, rewrite your tx). Bubble = number of companies; color = escape (none / painful / exists). Top-right is where the damage and the reach overlap. Surveillance isn't on this axis — analytics sits low here yet collects the most; that's what chart 1 measures.
4 · By gadget type — the flows
The actual data ribbons, actors folded into categories (Infura = Alchemy = RPC), sorted by reach. Box border = escape: red = none, amber = painful, green = exists. See the Gadget Shelf for the fix + cost.
5 · By company — who specifically
The same leaks, named — the 16 widest-reaching of the 43 companies that receive something. "The node provider" is one throat — but it's a different company per wallet.
6 · What the CROPS version looks like
For each gadget, the move that creates the self-sovereign counterfactual. Once the counterfactual exists, every hosted version has to explain why it doesn't work that way. Sorted by leverage: no escape first, widest reach first.
Wallet backendTURN IT OFF14/16 flows
Ship flags and defaults signed in the release; pull updates as signed public lists anyone can mirror — no per-user queries. What breaks: the vendor's instant kill-switch and A/B tests. Not your sends.
Hosted dApp frontendBUILD THE EXAMPLE2/16 flows
Pin the frontend to IPFS/ENS. The test is binary: does the dApp work with nothing hosted?
Fiat on/off-rampOPEN PROBLEM2/16 flows
No self-sovereign fiat rail exists; peer-to-peer is the only escape and it's thin. The open problem.
ERC-4337 bundlerRUN A REPLACEMENT1/16 flows
Self-bundle: wrap your own UserOp and submit it through your node.
TLS edge / CDNOPEN PROBLEMfronts the rest
Falls away only when what's behind it (frontends, backends) becomes self-hostable.
RPC — chain readsBUILD THE EXAMPLE14/16 flows
A wallet that ships with a light client (Helios) — reads verified against consensus, not trusted. Full escape stays your own node.
Block buildersSET A STANDARD14/16 flows
Protocol-level: forced-inclusion lists (FOCIL) so no builder can keep a tx out.
Wallet / code dist.SET A STANDARD12/16 flows
Reproducible builds signed by the team, verifiable outside the store.
Tx broadcast / relayBUILD THE EXAMPLE11/16 flows
Wallet-native p2p broadcast: hand the signed tx to the public mempool from your own machine.
Block explorerBUILD THE EXAMPLE11/16 flows
Otterscan on your own node today; 'your own etherscan' is an AI-buildable afternoon.
Indexer — balancesRUN A REPLACEMENT3/16 flows
Local indexing derived from your own node, behind the same wallet UI.
Prices & market dataRUN A REPLACEMENT3/16 flows
Read prices onchain (DEX TWAPs) — or go without fiat values.
Analytics / telemetryTURN IT OFF11/16 flows
Nothing to build. Default it to off.
Tx / address screeningSET A STANDARD9/16 flows
A signed public risk-list any wallet pulls and checks locally — no server sees the query.
Name resolution (ENS)ALREADY EXISTS2/16 flows
Your node already resolves ENS with one eth_call.
Tx simulationALREADY EXISTS1/16 flows
Local simulation against your own node works today — make it the default.
The categories from Access Vectors you can't route around today (NONE), plus RPC (PAINFUL), taken one at a time. Who holds each position, what it sees, what it can do, what you can do now, and what would have to exist. Counts come from the route data (a stop shared by several maps counts once per map); the own-node lines come from lab runs with the RPC set in each wallet (Your Own Node).
1
TLS edge / CDNzero option: NONE217 stops on 15 of 16 maps · 70% live-observed
Who holds it: Cloudflare edge (190), AWS CloudFront (27)
What it sees: Signed raw tx, Full unsigned tx, All account addresses, Selected address, Recipient address, Amount, Balances + positions
What it can do: block 83 of these stops, 31 of them with no setting to turn off; give 26 answers where a lie costs funds or ships code; link your IP to your addresses over time.
What you can do today: Unavoidable when using any hosted service. With your own node set in the wallet: 17 of 99 tested stops in this category moved off it; 82 still went to it.
What would have to exist: Falls away only when what's behind it (frontends, backends) becomes self-hostable. Fixes that retire the most of these stops: Local or verifiable indexing (46); Local address-risk checks (37); Verifiable RPC reads (34).
2
Wallet's own backend (flags, config, prices)zero option: NONE138 stops on 14 of 16 maps · 73% live-observed
Who holds it: Consensys · MM APIs (114), Rabby · DeBank API (20), Google · Firebase (2), WalletConnect (1), Ambire · monitor (1)
What it sees: Signed raw tx, Full unsigned tx, All account addresses, Selected address, Recipient address, Amount, Balances + positions
What it can do: block 32 of these stops, 14 of them with no setting to turn off; give 13 answers where a lie costs funds or ships code; link your IP to your addresses over time.
What you can do today: Use a wallet that has no phone-home backend. With your own node set in the wallet: 2 of 68 tested stops in this category moved off it; 66 still went to it.
What would have to exist: Ship flags and defaults signed in the release; pull updates as signed public lists anyone can mirror — no per-user queries. What breaks: the vendor's instant kill-switch and A/B tests. Not your sends. Fixes that retire the most of these stops: Local or verifiable indexing (35); Local address-risk checks (19); Independently hosted frontends (16).
3
Hosted dApp frontendzero option: NONE14 stops on 2 of 16 maps · 50% live-observed
Who holds it: Uniswap Labs (12), Avara · app.aave.com (1), Family (1)
What it sees: Selected address, Amount, Balances + positions, Tx hash, Swap route + quote (path, amountOut, minOut, Universal Router calldata), Swap token pair (tokenIn/tokenOut), IP address
What it can do: block 9 of these stops, 9 of them with no setting to turn off; give 3 answers where a lie costs funds or ships code; link your IP to your addresses over time.
What you can do today: Sometimes: self-host the UI or call the contract directly — often NOT possible. With your own node set in the wallet: 0 of 6 tested stops in this category moved off it; 6 still went to it.
What would have to exist: Pin the frontend to IPFS/ENS. The test is binary: does the dApp work with nothing hosted? Fixes that retire the most of these stops: Independently hosted frontends (2); Local or verifiable indexing (2); Verifiable RPC reads (1).
4
RPC — chain reads & writeszero option: PAINFUL65 stops on 13 of 16 maps · 89% live-observed
What it sees: Signed raw tx, Full unsigned tx, All account addresses, Selected address, Recipient address, Amount, Balances + positions
What it can do: block 47 of these stops, 2 of them with no setting to turn off; give 22 answers where a lie costs funds or ships code; link your IP to your addresses over time.
What you can do today: Run your own full node and point the wallet at it. Cost: Sync + run a full node — disk, time, upkeep. With your own node set in the wallet: 35 of 37 tested stops in this category moved off it; 2 still went to it.
What would have to exist: A wallet that ships with a light client (Helios) — reads verified against consensus, not trusted. Full escape stays your own node. Fixes that retire the most of these stops: Private RPC access (63); Verifiable RPC reads (53); Open simulation (9).
Each wallet with Ethereum pointed at a node on your own network, set in the wallet's own settings, then run in the lab. Green went to your node; red still left your machine; grey didn't come up in the run. Across these maps your node answered 38 of 153 tested requests (25%). The rest go to the same companies as before.
Rainbow Send45% of tested requests5 to your node · 6 still out · 11 not tested · +2 hosts no stop covers · real send ↗ · ⚗ lab run
Rainbow's platform API still gets your address, balances and tx list. A node elsewhere on your LAN is blocked by the extension; it has to run on the same computer.
Rabby polls the receipt with your tx hash seconds after you send, and its pre_exec_tx gets the full unsigned tx.
U1
Uniswap Swap13% of tested requests2 to your node · 13 still out · 26 not tested · +42 hosts no stop covers · dry run · ⚗ lab run
Uniswap reads the chain through its own gateway (unirpc).
M3
Aave Deposit11% of tested requests2 to your node · 17 still out · 22 not tested · +37 hosts no stop covers · dry run · ⚗ lab run
Aave's app reads the chain through its own server (app.aave.com/api/rpc-proxy). Your wallet's node never sees the dapp's reads.
ON
Fiat On-Ramp0% of tested requests0 to your node · 2 still out · 2 not tested · +58 hosts no stop covers · dry run · ⚗ lab run
MetaMask geolocates you and gates providers by region. Your node got 4 of MetaMask's background reads, none of them stops on this map.
OF
Fiat Off-Ramp0% of tested requests0 to your node · 3 still out · 5 not tested · +56 hosts no stop covers · dry run · ⚗ lab run
MetaMask geolocates you and gates providers by region; the provider page hits Infura with its own key. Your node got 4 of MetaMask's background reads, none of them stops on this map.
Correctness is the moat: before this map names who leaks, every claim has to be checkable. Here is what's backed by a live capture and what still isn't. Computed from the route data.
The evidence
67% of every data-exposure claim on these maps is backed by a live packet capture. The rest is traced from source code or inferred — and still needs a capture to confirm.
67%LIVE-OBSERVED
30%CODE-TRACED
Still to validate — 16 actors, no live capture yet
Traced from source or inferred, not yet seen on the wire. The queue for the next captures.
EtherscanCODE-TRACED30 claims
verify-a-tx is click-gated — not triggered by the automated send capture
Builders · relaysINFERRED14 claims
block builders / relays — inferred from protocol; every tx passes them
Pimlico bundlerCODE-TRACED13 claims
ERC-4337 bundler — smart-account infra, traced from code not a wallet call
Ambire · relayerCODE-TRACED12 claims
Ambire smart account can't onboard in the VM (needs a live relayer to derive its address) — the inability is itself the finding
Ambire · invictus RPCCODE-TRACED11 claims
same Ambire onboarding blocker
DeBankCODE-TRACED3 claims
capture pending
Ambire · cenaCODE-TRACED3 claims
same Ambire onboarding blocker
CCIP gatewayINFERRED2 claims
CCIP-read offchain resolver — only fires for names that use it
Avatar hostINFERRED2 claims
ENS avatar image host — cosmetic, not exercised in the captured send
Ethereum p2pREFERENCE2 claims
the Mountain Man's own broadcast — a constructed reference flow
AmplitudeCODE-TRACED2 claims
analytics — fires to an ingest subdomain the capture didn't decode
ENS metadataCODE-TRACED2 claims
ENS metadata/avatar service — not hit by a plain resolve
The GraphCODE-TRACED2 claims
indexer path — traced from code
Avara · app.aave.comCODE-TRACED1 claim
Aave app API — captured run exists (m3); these rows are code-traced
FamilyCODE-TRACED1 claim
Family/Rainbow name service — traced from code
Ambire · monitorCODE-TRACED1 claim
same Ambire onboarding blocker
Proven live — 27 actors
Seen in a mitmproxy capture; most on a real mainnet transaction. Links go to the lab run and the tx.
Every actor generalized to a category (Infura and Alchemy are both just "RPC"), ranked by prevalence — how many flows it sits on — and exposure — what it can do to you. The right column is the zero option: is there a fully self-sovereign fallback, and what does the Mountain Man do instead? None = top priority; painful = still worth fixing; local = the escape hatch already exists. Prevalence is an initial signal, not the final sort — weight later by real transaction volume. Computed from the route data.
1
TLS edge / CDNAWS CloudFront, Cloudflare edge
On 16 flows AB1APBRM1M2M3M4MTNOFONPWR1RB1RCU1 · can: can block (no setting removes it) · malicious code · links identity over time
zero option: NONE — no self-sovereign option · Mountain Man: Unavoidable when using any hosted service
Cloudflare/CloudFront front nearly everything. They can block by jurisdiction and terminate TLS. No self-sovereign option while using hosted services.
2
Wallet's own backend (flags, config, prices)Ambire · monitor, Consensys · MM APIs, Google · Firebase, LaunchDarkly, Rabby · DeBank API, Statsig, WalletConnect
On 15 flows AB1APBRM1M2M3M4MTNOFONR1RB1RCU1 · can: can block (no setting removes it) · malicious code · links identity over time
zero option: NONE — no self-sovereign option · Mountain Man: Use a wallet that has no phone-home backend
Feature flags, remote config, and defaults served from the wallet vendor. Proprietary; no self-sovereign version short of a different wallet.
On 14 flows AB1APBRM1M2M3M4MTNOFPWRB1RCU1 · can: can block (no setting removes it) · funds lost · links identity over time
zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Run your own full node and point the wallet at it
The single most prevalent dependency. Sees every read and takes your broadcast. A node is the fallback but costs sync time, disk, and upkeep.
4
Block builders & relaysBuilders · relays
On 14 flows AB1APBRM0M1M2M3M4MTOFPWR1RB1U1 · can: can block (no setting removes it)
zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Wait for a non-censoring local/among builder to include you
On EVERY flow. Can censor today in principle; the fix is Fossil / forced inclusion. Binary-ish: does a censorship-resistant path exist.
5
Block explorer (verify a tx completed)DeBank, Etherscan
On 11 flows APBRM1M2M3M4MTPWR1RB1U1 · can: false belief · links identity over time
zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Check against your own node / run your own explorer
Etherscan is a UNIVERSAL trust assumption — every user, even Mountain Men, sanity-checks a tx on Etherscan. A node confirms it, but people still trust the explorer's UI.
On 9 flows AB1APBRM1M2M3M4MTU1 · can: can block (no setting removes it) · funds stuck · links identity over time
zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Broadcast straight to your own node / the public mempool
Private relays (Smart Transactions) and bundlers sit between you and inclusion. Direct broadcast is the fallback but loses MEV protection and can be slow.
On 2 flows M3U1 · can: can block (no setting removes it) · malicious code · links identity over time
zero option: NONE — no self-sovereign option · Mountain Man: Sometimes: self-host the UI or call the contract directly — often NOT possible
THE hard gap. If a dApp's frontend depends on its own backend, you can't use it without them. Safe can be self-hosted; many can't. No zero option in the general case.
12
Fiat on-ramp / off-rampCoinbase on-ramp, MoonPay
On 2 flows OFON · can: can block (no setting removes it) · funds lost
zero option: NONE — no self-sovereign option · Mountain Man: Already hold crypto — earn it, get paid in it, or acquire peer-to-peer
The funnel entry. No private fiat rail exists: geolocation + jurisdiction gate + full KYC. The only zero option is to skip fiat entirely.
13
Name resolution (ENS)CCIP gateway, ENS metadata
On 2 flows M2M3 · can: can block (no setting removes it) · funds lost
zero option: LOCAL — self-sovereign version exists · Mountain Man: Resolve on-chain via your own node (eth_call)
ENS resolves on-chain; a node does it with no extra party. Metadata/avatar services are optional cosmetics.
14
Prices & market dataAmbire · cena, CoinGecko
On 2 flows AB1M3 · can: false belief
zero option: PAINFUL — exists, costs real UX/$ · Mountain Man: Run your own price feed, or go without fiat values
Fiat valuations and swap pricing. Degrades gracefully without it; a self-sovereign feed is possible but rarely done.
15
ERC-4337 bundler / paymasterPimlico bundler
On 1 flow AB1 · can: can block (no setting removes it) · funds lost
zero option: NONE — no self-sovereign option · Mountain Man: N/A — an EOA avoids it entirely
Smart-account infra. A 4337 account cannot even onboard or transact without a live bundler/paymaster (see Ambire). No offline option.
16
Avatars & token imagesAvatar host
On 1 flow M2 · can: sees your data
zero option: LOCAL — self-sovereign version exists · Mountain Man: Skip them
Cosmetic only. Leaks IP + address for a picture; trivially skippable.
The clean Mountain Man map hides his real UX. Every gadget the centralized flows outsource to a company (a leak you can see), the Mountain Man must run himself — at a cost the map never shows — or it's simply missing (no self-sovereign option today). This is that hidden shelf: per gadget, who the centralized flows use, what the Mountain Man does instead and what it costs, and whether you could build your own now with AI. The MISSING rows are the real gaps; the buildable now ones are where the cost is already dropping. Computed from the route data.
Mountain Man: Self-host the UI or call the contract raw — often impossible
THE hard gap. If a dApp's frontend depends on its own backend, you can't use it without them. Safe can be self-hosted; many can't. No zero option in the general case.
4
Fiat on-ramp / off-rampMISSINGnot buildable yet
Centralized flows use:Coinbase on-ramp, MoonPayOFON · outsourced on 2 flows
Mountain Man: No private fiat rail — earn it, get paid in it, or go P2P
The funnel entry. No private fiat rail exists: geolocation + jurisdiction gate + full KYC. The only zero option is to skip fiat entirely.
Centralized flows use:Builders · relaysAB1APBRM0M1M2M3M4MTOFPWR1RB1U1 · outsourced on 14 flows
Mountain Man: Wait for a non-censoring builder (Fossil fixes this)
On EVERY flow. Can censor today in principle; the fix is Fossil / forced inclusion. Binary-ish: does a censorship-resistant path exist.
8
Block explorer (verify a tx completed)SELF-RUN (costly)buildable now
Centralized flows use:DeBank, EtherscanAPBRM1M2M3M4MTPWR1RB1U1 · outsourced on 11 flows
Mountain Man: Run your own explorer (Otterscan) — or build one with AI
Etherscan is a UNIVERSAL trust assumption — every user, even Mountain Men, sanity-checks a tx on Etherscan. A node confirms it, but people still trust the explorer's UI.
Mountain Man: Broadcast to your own node / the public mempool
Private relays (Smart Transactions) and bundlers sit between you and inclusion. Direct broadcast is the fallback but loses MEV protection and can be slow.
ENS resolves on-chain; a node does it with no extra party. Metadata/avatar services are optional cosmetics.
16
Avatars & token imagesSELF-RUNbuildable now
Centralized flows use:Avatar hostM2 · outsourced on 1 flow
Mountain Man: Skip the images
Cosmetic only. Leaks IP + address for a picture; trivially skippable.
17
Transaction simulationSELF-RUNbuildable now
Centralized flows use:— · outsourced on 0 flows
Mountain Man: Run a simulator against your own node
Blockaid-style pre-sign simulation. A local version is feasible today — MetaMask required Blockaid to also ship an obfuscated local build. Good-enough local sim exists.
Every actor on 2+ maps, or where a lie costs funds or code, or with a block no setting removes. CROPS scored 0–3 per axis, 0 worst: Censorship-Resistance (can they block?) · Open-source · Privacy (what they collect) · Security (what a lie costs). Computed from the route data, not hand-ranked.
1
Cloudflare edgeTLS terminates here for every fronted API call
Serves AB1APBRM1M2M3M4MTNOFONPWRB1RCU1 · receives · CROPS CR0 · O0 · P0 · S0 · a lie ⇒ malicious code · can block, no escape · can link identity over time
The interventions from the working list, ranked by what each retires across the maps: requests, funds-level lies, blocks no setting removes, answers that shape what you sign. Computed from the route data, not hand-ranked.
1
Verifiable RPC reads
Light-client or proof-backed reads: the answer can be checked, so the RPC can't lie about state.
Retires 37 requests across 15 maps · 14 where a lie costs funds or code · 4 blocks no setting removes · 16 that shape what you sign · 37 that carry identity AB1APBRM1M2M3M4MTNOFPWR1RB1RCU1
2
Private RPC access
Reads and broadcasts that don't tie your IP to your addresses.
Retires 37 requests across 15 maps · 13 where a lie costs funds or code · 2 blocks no setting removes · 16 that shape what you sign · 37 that carry identity AB1APBRM1M2M3M4MTNOFPWR1RB1RCU1
3
Independently hosted frontends
App and wallet code built and served outside one store, CDN, or remote flag service.
Retires 22 requests across 10 maps · 11 where a lie costs funds or code · 10 blocks no setting removes · 3 that shape what you sign · 22 that carry identity AB1M3M4NOFONPWR1RB1U1
4
Censorship-resistant broadcast
A path to inclusion that no single relay, RPC, or builder set can filter.
Retires 16 requests across 14 maps · 4 where a lie costs funds or code · 11 blocks no setting removes · 5 that shape what you sign · 9 that carry identity AB1APBRM0M1M2M3M4MTOFPWR1RB1U1
5
Portable clear-signing data
Open metadata that lets the wallet say locally what calldata does.
Retires 6 requests across 6 maps · 3 where a lie costs funds or code · 2 blocks no setting removes · 3 that shape what you sign · 6 that carry identity APM3NOFR1U1
6
Open simulation
Run the tx preview yourself instead of trusting a closed simulator's answer.
Retires 5 requests across 10 maps · 2 where a lie costs funds or code · 1 block no setting removes · 5 that shape what you sign · 5 that carry identity AB1APBRM1M2M3M4MTR1U1
7
Local or verifiable indexing
Balances, history, and positions from your own or provable index, not a closed API fed all your addresses.
Retires 23 requests across 13 maps · 1 block no setting removes · 23 that carry identity AB1APBRM1M2M3M4MTNPWR1RB1U1
8
Local address-risk checks
Phishing, sanctions, and scam screening against open local data — not a vendor that sees every recipient pre-sign.
Retires 9 requests across 11 maps · 6 that shape what you sign · 9 that carry identity AB1APBRM1M2M3M4MTNR1U1
45 third-party requests match no fix on this list — mostly prices, APRs, analytics, and avatars.