What NODAL is
NODAL does privacy testing for Web3 apps. It shows builders what their app sends to outside services when a user connects a wallet or prepares an action, and turns those observations into evidence they can fix and retest.
The trace engine, its detection rules, a command-line tool and the examples are open source on GitHub: github.com/nodalsi/trace-engine.
It analyses observed traffic. It cannot prove that an app never leaks data, and it cannot see traffic that was not captured.
Trace Lab is the first stage. The roadmap is NODAL Privacy CI: run named wallet scenarios on each build and flag new or undeclared third-party disclosures against the team’s policy Planned, then publish an Observed Data Manifest with the release Planned. See Privacy CI.
To see a real browser capture, run the wallet-flow example In development: Playwright drives an EIP-6963 / EIP-1193 wallet-connection flow on a synthetic dApp, and Trace Lab shows what the app sent.
Capture a HAR trace
- Use a test wallet and test accounts. HAR files record everything the page sends.
- Open your app, then DevTools → Network. Enable Preserve log, and clear the list.
- Run one journey: connect wallet, open the page you care about, prepare a transaction.
- Right-click the request list → Save all as HAR (Chrome, Edge, Brave) or the gear menu → Save All As HAR (Firefox).
- Note the scenario and app build. You will enter them in Trace Lab so the report states what was tested.
Chrome may strip cookies and auth headers from HAR exports by default. That is fine: NODAL never exports their values anyway.
Analyse it
- Open Trace Lab → Import HAR, read the notice, and choose the file. It is read in your tab only.
- Enter your test wallet address and any transaction hash. Matches become direct evidence.
- Enter your own hostnames as first-party so they are not mixed with third parties.
- Review each finding, mark it expected, unexpected or investigate, and export.
Direct vs heuristic evidence
| Evidence | Meaning | Example |
|---|---|---|
| direct | Equals a value you declared, possibly lower-cased or without 0x | Your test wallet in body.userId to an analytics host |
| heuristic | Only looks like a wallet value | A checksummed address that might be a token contract |
Severity
| Value → host category | Severity |
|---|---|
| Wallet address or ENS → analytics, session replay, advertising | high (medium if only a weak heuristic) |
| Wallet address or ENS → error tracking, unknown third party | medium |
| Transaction hash → analytics, replay, ads | medium |
| Transaction hash → error tracking, unknown third party | low |
| Anything → RPC, wallet infrastructure, first party · chain IDs | info |
Severity is a triage aid, not a verdict. An RPC provider receiving your address is expected for most dApps, but it can still log it together with the user's IP address.
Host categories
Hosts are classified by hostname suffix against a built-in list (for example segment.io → analytics, sentry.io → error tracking, infura.io → RPC). A hostname says who runs a server, not what it does with the data. Unknown hosts are shown as “other third party” so you review them yourself.
Where NODAL looks
URL paths and fragments, query parameters, request headers (including Referer and Cookie), and request bodies as JSON, newline-delimited JSON, form data or plain text. Response bodies, WebSocket frames and anything not in the HAR are not analysed. See the threat model.