DOCUMENTARY RESEARCH / EN-IE7 EVIDENCE RUNS · PUBLIC EVIDENCE REVIEWED
AXIALPROOF / RESEARCH LAB

WALLET BOUNDARY RUN

MetaMask

Boundary protocol documents self-custody, alternative recovery paths, swap-fee composition, telemetry controls and the limits of public repository and audit evidence.

OUTPUT
PUBLISHED REVIEW
DOCUMENT GATE
PUBLIC EVIDENCE REVIEWED
SCENARIO RUN
PUBLISHED
BOARD
SAME-CLASS ELIGIBLE
REVIEWED
CONFIDENCE
MEDIUM
PROTOCOL SCOPE

MetaMask browser/mobile documentation refreshed 16 August 2026; wallet creation, asset movement and malicious-signing experiments are specified as controlled runs.

EDITORIAL OUTPUT

ASSESSMENT

MetaMask passes a documentary self-custody classification while failing any simplistic ‘no server, no telemetry, fully open source’ assertion. Recovery mode and feature selection are mandatory protocol parameters.

AUDIENCE

SUITABLE FOR

Users prepared to model recovery compromise, inspect permissions and configure telemetry rather than treating self-custody as automatic privacy or safety.

DECISION VARIABLE

PRIMARY TRADE-OFF

Dapp reach and recovery flexibility expand usability while introducing more service, privacy and signing boundaries to validate.

DOCUMENTARY AXES

What the records establish — and what they cannot.

Each axis distinguishes a documentary result from the controlled scenario protocol.

KY

KEY AXIS

DOCUMENT / MetaMask documents user-held signing control.

LIMIT / Self-custody does not prove feature-level server independence.documented
SG

SIGNING AXIS

DOCUMENT / User approval is required and security simulation may query MetaMask or Blockaid.

LIMIT / Prompt clarity and malicious-signature resistance are untested here.documented
RC

RECOVERY AXIS

DOCUMENT / Secret Recovery Phrase and social sign-in paths have distinct recovery dependencies.

LIMIT / Failure rates and compromise resistance require controlled scenarios.documented
SW

SOFTWARE AXIS

DOCUMENT / Extension/mobile repositories and scoped assessments are public under restrictive licences.

LIMIT / Visible source does not prove binary reproducibility or full audit coverage.documented
OPEN TEST PROTOCOL →
SUPPORTING SIGNALS

STRENGTHS

  • Detailed recovery and self-custody support material
  • Public code repositories
  • Scoped security programme and configurable MetaMetrics
BOUNDARY CONDITIONS

LIMITATIONS

  • Social recovery adds encrypted online shards
  • Swaps include a documented service fee plus route costs
  • Repository publication and assessments do not cover every runtime dependency

PROTOCOL MODULES

Document result, then define the next reproducible run.

No scenario is labelled complete unless inputs, environment, steps and limitations are captured.

W-01

Boundary map

User signing authority and service-dependent features are separated.

NEXT RUN / Record network calls for a fixed version and feature set.DOCUMENTED
W-02

Recovery matrix

Traditional and social recovery are documentary-distinct.

NEXT RUN / Test device loss and account compromise with empty wallets.DOCUMENTED
W-03

Cost case

A 0.875% swaps fee plus route costs is documented.

NEXT RUN / Capture final received value across comparable routes.DOCUMENTED
W-04

Provenance

Repositories, licences and audits are scoped.

NEXT RUN / Verify store binary/version and assessment coverage.DOCUMENTED

ANALYSIS OUTPUT

Protocol interpretation

Primary artefacts sit beside each result. Documentary proof is never promoted into an unobserved runtime claim.

A-01

P0 / Authority boundary

MetaMask documentation supports the proposition that the user controls signing credentials. The proof is about authority, not isolation: swaps, telemetry and simulation may still call services. A test design must name the feature before asserting ‘local only’ behaviour.

SOURCES / MetaMask Support · MetaMask Support
REVIEWED
A-02

P1 / Recovery variants

Secret Recovery Phrase onboarding concentrates recovery in user-held words. Google, Apple or Telegram routes use encrypted online shards and a different dependency graph. The lab treats them as two recovery protocols, each requiring device-loss and account-compromise cases.

SOURCES / MetaMask Support · MetaMask Support
REVIEWED
A-03

P2 / Swap-cost equation

The reviewed guide states a 0.875% MetaMask fee in addition to network and route-dependent costs. Gas sponsorship can alter who pays one network component without making the swap economically free. The benchmark output should be received amount, not a fee badge.

SOURCES / MetaMask Support
REVIEWED
A-04

P3 / Telemetry request map

MetaMetrics may collect events that include a wallet address or transaction hash in selected contexts, while security simulation may involve MetaMask or Blockaid. Documentation defines possible flows; only instrumented observation can show which calls occur under a particular setting and action.

SOURCES / MetaMask Support · MetaMask
REVIEWED
A-05

P4 / Provenance limit

Public extension and mobile repositories improve inspectability, but current licences are restrictive and should not be labelled universally permissive open source. Security assessments are similarly bounded by version and scope. Neither artefact alone proves the distributed binary matches reviewed code.

SOURCES / GitHub / MetaMask · GitHub / MetaMask · MetaMask
REVIEWED
A-06

P5 / Third-party support incident

Consensys located its 2023 event in a customer-support ticket system and said wallet software and private keys were not compromised. The incident validates a support-data exposure class, not a signing-key exploit. Future phishing-resistance scenarios should use that distinction.

SOURCES / Consensys
REVIEWED

DEEP PROTOCOL ARRAY / 10 RUNS

Every claim gets fixed inputs, a procedure and a pass artefact.

Documentary baselines were retrieved on . Protocol outputs are published with fixed inputs, procedures and pass artefacts.

USE

EVM dapp signing and active permission management are required.

The wallet exposes a testable signing boundary.

USE

Disposable-wallet and hardware tests are acceptable.

Risky flows can be evaluated without valuable assets.

AVOID

Provider reversal/recovery is required.

Self-custody cannot provide that output.

AVOID

Zero telemetry and service dependency are assumed.

RPC, simulation, swaps and MetaMetrics must be mapped.

Build lock

Objective
Fix extension/mobile version and provenance.
Fixed inputs
One OS/browser, current official build, hash/store identity.
Procedure
Record distribution, version, repository/release link.
Document baseline
Separate public repositories exist.
Pass artefact
Installed build has traceable official provenance.

SOURCES / GitHub / MetaMask · GitHub / MetaMask

Authority boundary

Objective
Verify who can sign and which services participate.
Fixed inputs
Disposable wallet, default settings.
Procedure
Create wallet, inspect credentials and network calls for a basic action.
Document baseline
Provider describes self-custody with optional services.
Pass artefact
Signing authority and service dependencies are separately logged.

SOURCES / MetaMask Support · MetaMask Support

Recovery-mode run

Objective
Compare loss/compromise conditions.
Fixed inputs
Traditional SRP and available login/key-share path, separate wallets.
Procedure
Recover on clean device; record factors, imported accounts and failure modes.
Document baseline
Recovery architectures differ.
Pass artefact
Each route restores expected accounts without leaking secrets.

SOURCES / MetaMask Support · MetaMask Support

Malicious-approval comprehension

Objective
Measure warning/signature clarity.
Fixed inputs
Controlled token, approval, permit message and hardware device if supported.
Procedure
Present known-safe and suspicious variants; record fields, simulation, reject/revoke.
Document baseline
Security programme documents mitigations, not universal prevention.
Pass artefact
Spender, amount, chain and consequence are visible before signing.

SOURCES / MetaMask

Code/audit scope

Objective
Bind source and assessment to build/version.
Fixed inputs
Current repositories and named security artefacts.
Procedure
Record licence, commit/release, report scope/date/exceptions.
Document baseline
Public code and reviews are scoped.
Pass artefact
No whole-product claim exceeds artefact coverage.

SOURCES / GitHub / MetaMask · GitHub / MetaMask · MetaMask

Swap total cost

Objective
Measure provider fee, route and gas.
Fixed inputs
Same chain/pair/amount/block window.
Procedure
Capture route, 0.875% disclosure if applicable, price impact, minimum received and gas.
Document baseline
Current guide discloses layered costs.
Pass artefact
Quote reconciles to final received value.

SOURCES / MetaMask Support

Funding/bridge dependency

Objective
Map third parties in built-in routes.
Fixed inputs
One purchase or bridge route with disposable value.
Procedure
Identify provider, terms, permissions, fee, network and remedy.
Document baseline
Self-custody does not make integrated providers disappear.
Pass artefact
Every party and irreversible hand-off is recorded.

SOURCES / MetaMask Support · MetaMask Support

Permission lifecycle

Objective
Test connect→approve→revoke.
Fixed inputs
Controlled dapp, token and two account states.
Procedure
Connect, approve capped/unlimited, inspect, revoke and retry.
Document baseline
User authorises dapp requests.
Pass artefact
Authority changes match the displayed state onchain.

SOURCES / MetaMask

Telemetry/RPC map

Objective
Measure data paths by setting.
Fixed inputs
MetaMetrics on/off and selected RPC/security settings.
Procedure
Capture requests/fields for identical benign actions.
Document baseline
Documents describe configurable telemetry and services.
Pass artefact
Observed recipients and setting effects are reproducible.

SOURCES / MetaMask Support · MetaMask

Support boundary

Objective
Verify anti-impersonation and non-reversibility.
Fixed inputs
Official channel, no-value wallet, benign recovery question.
Procedure
Record identity request, SRP warning, hand-offs and software-issue escalation.
Document baseline
Support incident history makes channel integrity relevant.
Pass artefact
No secret request; correct recovery limits and escalation are stated.

SOURCES / MetaMask Support · Consensys

DECISION ENVIRONMENTS

Run the product as a user would decide.

D-1

EVM learner

Environment / Disposable extension wallet.

Variables / Connect/approve/revoke.

Output / Permission comprehension.

PUBLISHED
D-2

Hardware signer

Environment / Supported device and controlled contract.

Variables / Approval/permit.

Output / Cross-screen intent output.

PUBLISHED
D-3

Swap user

Environment / Fixed chain/pair/block.

Variables / MetaMask versus direct route.

Output / Total-cost output.

PUBLISHED
D-4

Privacy-conscious user

Environment / Metrics on/off and RPC states.

Variables / Identical benign actions.

Output / Network-recipient diff.

PUBLISHED

CHANGE SIGNALS

Timeline affecting the rig.

  1. Support data incident disclosed.

    Support/privacy boundary included.

  2. Current public extension release visible.

    Build provenance input refreshed.

  3. Recovery/swap/telemetry sources refreshed.

    Runtime rigs are published as fixed protocol outputs.

ALTERNATIVE RIGS

Test another object when the variable changes.

Trust Wallet

Broader chain coverage leads.

Hardware wallet + narrow companion

Key isolation leads.

STOP GATE

MEDIUM CONFIDENCE

BASIS
Official docs and repositories establish recovery, fee and telemetry baselines.
BLOCK
Controlled runs for signing, recovery, provenance, runtime data and routes are published as fixed protocol outputs.
CHANGE CONDITION
Recovery/default telemetry/signature changes or strong security evidence alter the assessment.

METHOD

Control discipline.

  1. Use disposable wallets only.
  2. Lock build and recovery mode.
  3. Measure authority and data separately.
  4. Reconcile route costs onchain.

CHANGE LOG

Rig revisions.

Added ten wallet-boundary rigs and four safe user environments.

FAQ

Protocol questions.

Can support recover an SRP?

No.

Does hardware eliminate phishing?

No.

Are swaps free?

No.

Does self-custody prove privacy?

No.

SRC

Primary-source register

Document review dated . Author: Axial Proof Editorial Team. Independent reviewer: Axial Proof Review Team.

ARTEFACTS