The problem
Many Web3 privacy issues happen off-chain. A dApp, or one of its dependencies, sends wallet-related data to third parties: analytics, session replay, error tracking, ad networks or CDNs. Combined with an IP address, device fingerprint or account, a wallet address links on-chain activity to a real person. Academic work has measured this kind of leakage across dApps (research).
NODAL is not the first tool to inspect dApp traffic (for example DApp Inspector). Its aim is a repeatable release workflow with evidence a team can act on.
Who receives the data
| Receiver | Typical cause | Why it matters |
|---|---|---|
| Analytics and tag managers | identify(address), page URLs with addresses | Links wallet to device, sessions and other sites |
| Session replay | Recorded DOM showing balances and addresses | Full behavioural record tied to the wallet |
| Error tracking | Error messages and breadcrumbs | Often accidental and kept for months |
| CDNs and other third parties | Referer headers carrying page URLs | Invisible in application code review |
| RPC providers | Balance and transaction calls | Usually necessary, but logs pair address with IP |
What Trace Lab detects
- Declared wallet addresses and transaction hashes, exact, lower-cased or without
0x, anywhere in captured requests. - Heuristic Ethereum-style addresses (EIP-55 checksum raises confidence), 32-byte hex values, ENS names and chain IDs.
- Locations: URL path and fragment, query, headers including
RefererandCookie, JSON, newline-delimited JSON, form and text bodies, including URL-encoded content.
Blind spots Unresolved
- Not captured, not seen. WebSocket frames, some service-worker traffic, browser-extension traffic and other journeys.
- Transformed data. Hashed, encrypted, compressed, base64-wrapped or deliberately obfuscated values.
- Non-EVM formats. Solana, Bitcoin and other address formats are not detected yet.
- After receipt. What a host does with data once it has it.
- Network metadata. IP addresses, timing and who talks to whom. NODAL looks at request content, not the network layer. Network privacy systems such as the Nym mixnet address this layer. Testing apps that use privacy-routed RPC is being explored; no integration is announced.
- Classification. Host categories come from hostnames and can be wrong.
Trust boundaries of NODAL itself
- HAR files are treated as untrusted input: size and entry caps, safe JSON parsing, no evaluation, truncated bodies.
- The site ships a Content Security Policy with
connect-src 'none': the page cannot send data anywhere. Automated tests check that importing a trace makes no network request. - No accounts, analytics, storage or wallet connection.
- Exports are redacted by default; cookie and authorization values are never exported.
- Before teams rely on NODAL in CI, engineers should review parser safety, test coverage and bypass paths.
Claims NODAL will not make
No universal privacy score. No “safe”, “anonymous”, “compliant” or “leak-free” badge. The planned Observed Data Manifest reports only what was observed in the stated scenarios. A signature could authenticate who published it, but it cannot prove the tested app had no other behaviour, and it is not a certification or security guarantee.