Poster: I Know What Crypto You Got Last Summer: A Study on Web3 Wallet Security and Privacy

Web3, also known as the Decentralized Web, is a vision for the next generation of Web applications, supported by blockchain technology, where users have stronger ownership over their data and identity. One of the key components in Web3 is wallets, which hold a user’s public and private keys, manage digital tokens, and sign transaction details. Despite their significance in securely managing digital identities, wallets also introduce vulnerabilities that, if overlooked, can compromise users’ privacy and security, particularly during data exchange with network endpoints. We investigate how popular wallets like MetaMask can inadvertently expose sensitive information to RPC endpoints, even when no transactions are made. Additionally, we examine the confidentiality risks associated with the registration requirements of major node providers, highlighting how the collection of personal and financial details can further threaten user privacy. We briefly report on ongoing work in analyzing the characteristics of wallets across various blockchain networks to identify key security and privacy features that can be integrated into new wallet designs. This research aims to address the challenges inherent in wallet security and privacy within Web3.