A throwaway macOS VM ran the real wallet; every byte was captured and decrypted from the host, outside the guest. The full request log (flows.jsonl) holds decrypted bodies and stays private — tooling at github.com/austintgriffith/crops-lab.
run_id: 20260924-214539-swap-uniswap-localnode action: swap-uniswap-localnode guest_ip: 192.168.64.15 host_proxy: 192.168.64.1:8080 base_image: crops-warm action_rc: 0 gold_baked_at: 2026-08-21T02:54:20Z gold_base: ghcr.io/cirruslabs/macos-tahoe-base:latest gold_base_row: OCI ghcr.io/cirruslabs/macos-tahoe-base:latest 50 33 1 hour ago stopped gold_macos: 26.6.2 (25G83) gold_chrome: Google Chrome 151.0.7922.174 gold_node: v26.7.0 gold_playwright: 1.62.1 gold_quic_allowed: 0
[t=1790308004.442] rpc-edit: start -> http://192.168.68.54:8545 (then swap-uniswap) [t=1790308004.557] rpc open-networks: clicked [t=1790308005.502] rpc manage-networks: clicked [t=1790308007.962] rpc eth-options: clicked [t=1790308008.935] rpc edit: clicked [t=1790308009.884] rpc rpc-dropdown: clicked [t=1790308010.855] rpc add-rpc: clicked [t=1790308013.403] rpc add-url: clicked [t=1790308014.350] rpc save: clicked [t=1790308020.807] rpc-edit: done — browser restarted; everything after this is on http://192.168.68.54:8545 [t=1790308022.301] swap-uniswap: ext canglmpflkjehkfaioejbblmakepelcl · swap 0.0003 ETH -> USDC · broadcast false [t=1790308028.871] wallet unlocked [t=1790308060.496] connect: MetaMask option clicked: false [t=1790308083.653] connected: false [t=1790308088.711] picked USDC [t=1790308091.373] amount entered: 0.0003 [t=1790308115.621] dapp confirm-swap clicked: false [t=1790308124.737] mm swap-tx-dry: reached (NOT confirming — dry) [t=1790308124.738] swap-uniswap: reached swap-tx confirm (dry, not broadcast)
# capture 20260924-214539-swap-uniswap-localnode action: swap-uniswap-localnode · guest 192.168.64.15 · proxy 192.168.64.1:8080 · action_rc 0 ## decrypted: 1411 requests · 75 hosts | host | req | methods | secret headers present | |---|---:|---|---| | app.uniswap.org | 799 | GET/HEAD/POST | cookie | | entry-gateway.backend-prod.api.uniswap.org | 116 | GET/OPTIONS/POST | cookie,x-api-key | | tron-mainnet.infura.io | 72 | GET/OPTIONS/POST | — | | sentry.io | 35 | POST | — | | privy.app.uniswap.org | 33 | GET/OPTIONS/POST | cookie | | bitcoin-mainnet.infura.io | 29 | GET | — | | user-storage.api.cx.metamask.io | 22 | GET | authorization | | solana-mainnet.infura.io | 18 | GET/OPTIONS/POST | — | | 192.168.68.54 | 18 | POST | — | | metrics.interface.gateway.uniswap.org | 17 | OPTIONS/POST | — | | interface.gateway.uniswap.org | 14 | GET/OPTIONS/POST | — | | price.api.cx.metamask.io | 11 | GET | authorization | | accounts.api.cx.metamask.io | 10 | GET | authorization | | monad-mainnet.infura.io | 10 | POST | — | | api.segment.io | 8 | POST | — | | base-mainnet.infura.io | 8 | POST | — | | bsc-mainnet.infura.io | 8 | POST | — | | linea-mainnet.infura.io | 8 | POST | — | | polygon-mainnet.infura.io | 8 | POST | — | | optimism-mainnet.infura.io | 8 | POST | — | | arbitrum-mainnet.infura.io | 8 | POST | — | | subscription.api.cx.metamask.io | 8 | GET | authorization | | metamask.github.io | 7 | GET | — | | notification.api.cx.metamask.io | 7 | POST | authorization | | android.clients.google.com | 7 | POST | authorization | | authentication.api.cx.metamask.io | 6 | GET/POST/PUT | authorization | | cma.itunes.apple.com | 6 | POST | — | | mainnet.infura.io | 5 | POST | — | | static.cx.metamask.io | 5 | GET | — | | tokens.api.cx.metamask.io | 5 | GET | authorization | | pancake.apple.com | 5 | GET | — | | www.google.com | 4 | GET | — | | on-ramp-cache.api.cx.metamask.io | 4 | GET | — | | api.merkl.xyz | 4 | GET | — | | carrot.megaeth.com | 4 | POST | cookie | | testnet-rpc.monad.xyz | 4 | POST | — | | sepolia.infura.io | 4 | POST | — | | linea-sepolia.infura.io | 4 | POST | — | | raw.githubusercontent.com | 4 | GET | — | | bag.itunes.apple.com | 3 | GET | — | | token.api.cx.metamask.io | 3 | GET | — | | client-config.api.cx.metamask.io | 3 | GET | — | | cdn.contentful.com | 3 | GET | — | | gateway.api.cx.metamask.io | 3 | GET | cookie | | accounts.google.com | 2 | POST | — | | geolocation.api.cx.metamask.io | 2 | GET | — | | chainid.network | 2 | GET | — | | phishing-detection.api.cx.metamask.io | 2 | GET | — | | acl.execution.metamask.io | 2 | GET | — | | images.ctfassets.net | 2 | GET | — | | nft.api.cx.metamask.io | 2 | GET | — | | challenges.cloudflare.com | 2 | GET | — | | auth.privy.io | 2 | GET/OPTIONS | — | | content-autofill.googleapis.com | 2 | GET | — | | nbstream.binance.com | 2 | GET | — | | coin-images.coingecko.com | 2 | GET | — | | example.com | 1 | GET | — | | clients2.google.com | 1 | GET | — | | client-side-detection.api.cx.metamask.io | 1 | GET | — | | bridge.api.cx.metamask.io | 1 | GET | — | | rewards.api.cx.metamask.io | 1 | POST | — | | defiadapters.api.cx.metamask.io | 1 | GET | — | | oidc.api.cx.metamask.io | 1 | POST | — | | device-config.pcms.apple.com | 1 | GET | — | | explorer-api.walletconnect.com | 1 | GET | — | | tokens.coingecko.com | 1 | GET | — | | nbstream.binance.info | 1 | GET | — | | didcmo2jyrnku.cloudfront.net | 1 | GET | — | | api.web3modal.org | 1 | GET | — | | nbstream.yshyqxx.com | 1 | GET | — | | pulse.walletconnect.org | 1 | POST | — | | assets.coingecko.com | 1 | GET | — | | token-icons.s3.amazonaws.com | 1 | GET | — | | calendars.icloud.com | 1 | GET | — | | token.safebrowsing.apple | 1 | GET | — | ## opaque: 0 SNIs offered, never decrypted (pinned or handshake failed) - none ## wire: 10038 proxied pkts · 5 BYPASS dst · 2 QUIC dst · 1274 Apple-OS pkts BYPASS/QUIC below exclude Apple 17.0.0.0/8 (macOS push/OCSP/update — not the browser under test). ### BYPASS — guest spoke TLS to these directly, not through the proxy - 23.14.140.152 (no DNS seen) · 101 pkts - 23.47.200.181 (?) · 55 pkts - 23.37.97.92 (?) · 21 pkts - 199.232.67.6 (no DNS seen) · 6 pkts - 23.64.99.186 (no DNS seen) · 5 pkts ### QUIC LEAK — udp/443 left the guest - 199.232.67.6 (no DNS seen) · 62 pkts - 199.232.65.64 (?) · 17 pkts ### other egress (non-443, non-DNS) - 192.168.64.255:137 (no DNS seen) · 18 pkts - 23.11.33.159:80 (no DNS seen) · 16 pkts - 104.18.38.233:80 (no DNS seen) · 4 pkts - 224.0.0.251:5353 (no DNS seen) · 3 pkts