Inspect wallet-related data flows in captured app traffic. Find the request, see the evidence, and catch privacy regressions before release.
Local-first prototype · no wallet connection · no trace uploads
01 · observed in the sample trace
A test wallet connects to a sample dApp. NODAL traces each captured request and identifies the destination and exact fields it received.
02 · how it works
Run a wallet journey in your app with DevTools open, then export the Network tab as a HAR file. Use a test wallet.
In developmentTell NODAL your test wallet, any transaction you made, and which hosts are yours. That turns pattern matches into direct evidence.
First buildEvery finding names the host, the request and the exact field — query, header, JSON path — and says why it might be a false positive.
First buildMark flows expected, unexpected or to investigate. Export a redacted report and a findings file for your issue tracker.
First build03 · evidence format
Each finding separates direct evidence from heuristics, carries the request location, and ships with its own limitations. Exports are redacted by default.
body.userId, query: uid, header: referer04 · threat model
Referer header and cookiesNODAL analyses observed traffic. It cannot prove an app never leaks data, and it never issues a privacy score, a “safe” badge or a compliance claim. Full threat model →
05 · roadmap
Trace Lab is step one. Privacy CI is the main expansion: repeatable, Playwright-based privacy tests in the build and release process. Each step is labelled by what exists today, not by what is promised.
Project story
A year in the making. Built for what comes next.
NODAL began with one question: what does a wallet reveal when it connects to Web3? The Trace Lab is the first public layer of a broader effort to map privacy across network traffic, wallet requests, and on-chain activity.
Public today: Trace Lab · Everything below carries its real status
Interactive sample and evidence-led findings: the host, the request, the exact field, and whether the evidence is direct or heuristic. Local HAR import.
A runnable example: Playwright drives a common wallet-connection flow and Trace Lab shows what the app sent. Two flows run today with the NODAL test wallet: a direct EIP-6963 / EIP-1193 connection, the interfaces injected wallets such as MetaMask use, and the same connection through Reown AppKit.
Repeatable Playwright-based tests in the build and release process. Flag new or undeclared third-party disclosures against the project’s declared policy, with the request evidence attached. Optional Observed Data Manifest per release.
Opt-in pilot reports for dApp teams, once the workflow exists. A team provides a test flow, reviews the report, and decides whether it is published.
Nym’s mixnet protects who talks to whom. NODAL shows what the app put in the request. Next question: can a test prove which RPC calls stayed on a privacy route, such as Nym’s anon-rpc worker for the draft anon-rpc specification, and which bypassed it?
nodal ci · sample-dapp 2.4.0 · baseline 2.3.1 · playwright policy nodal.policy.yml · 3 scenarios pass connect-wallet 9 requests no new flows FAIL swap-quote 12 requests 1 undeclared flow wallet.address → metrics.example.test (analytics) POST /v1/track · body.userId · direct · new since 2.3.1 pass sign-permit 14 requests no new flows release check failed · 1 undeclared third-party disclosure not analysed: websocket frames, service workers, extensions
{
"schema": "nodal.manifest/v0",
"app": "sample-dapp", "build": "2.4.0",
"scenarios": ["connect-wallet", "swap-quote", "sign-permit"],
"environment": { "browser": "chromium", "capture": "playwright" },
"observed": [
{ "value": "wallet.address", "host": "rpc.example.test",
"category": "rpc", "declared": true },
{ "value": "wallet.address", "host": "metrics.example.test",
"category": "analytics", "declared": false }
],
"notAnalysed": ["websocket frames", "service workers", "extensions"],
"limits": "Observed in the listed scenarios only. Not proof of absence."
}
It is
It is not
| Status | Item | What it means |
|---|---|---|
| Live | Nothing yet | Reserved until a feature exists, works and has been checked. |
| First build | Trace Lab synthetic sample | Made-up, clearly labelled traffic you can explore now. |
| In development | Trace Lab: local HAR import, evidence findings, redacted export | Implemented and unit-tested; needs engineering review before teams rely on it. |
| In development | Wallet-flow examples: injected wallet and Reown AppKit (Playwright, test wallet) | Run end to end on a synthetic dApp. WalletConnect QR / relay flows not covered yet. |
| Planned | Privacy CI: Playwright scenarios and policy check in builds and releases | Flag new or undeclared third-party disclosures, with evidence. |
| Planned | Observed Data Manifest | Version-specific record of what was observed in named scenarios. Not proof of absence. |
| Planned | NODAL Privacy Lab pilot | Not launched. Opt-in, team-approved reports once the workflow exists. |
| Exploring | Privacy-routed RPC testing (anon-rpc draft; Nym’s anon-rpc worker) | Open question. No integration announced. |
| Unresolved | WebSockets, service workers, extensions, obfuscation, all journeys | Open problems. Reports list them as blind spots. |
06 · try it · wallet-flow example
Playwright opens a synthetic dApp in a real browser, discovers a wallet over EIP-6963, connects over EIP-1193, reads a balance and signs in. NODAL records every request the page makes and shows which wallet-related values went where.
07 · privacy across layers
Network privacy and wallet request privacy address different exposure surfaces. Network privacy systems such as Nym focus on network-level metadata. NODAL examines wallet-related data visible in captured dApp requests.
Each wallet-related value in the captured requests, the host that received it and the exact field. Per-finding detail
A request can travel over a private network route and still carry a wallet address in its body. Protecting one layer does not protect the other, so each needs its own tools.
| Area | What it covers | Status |
|---|---|---|
| Wallet-level exposure | Trace Lab: which wallet values a dApp sent, to which host, in which field, with evidence. | In development |
| Wallet-connection flows | Injected wallets (EIP-6963 / EIP-1193) and Reown AppKit, driven with Playwright on a synthetic dApp. | In development |
| Privacy regression tests | Privacy CI: repeatable Playwright scenarios in build and release pipelines, such as GitHub Actions. | Planned |
| Privacy-routed RPC | Whether NODAL could test apps that route RPC through a privacy network, such as the draft anon-rpc specification or Nym’s anon-rpc worker, and flag requests that bypass the route. | ExploringNo integration announced |
| Network-layer metadata | Not measured by NODAL. This is the job of network privacy systems. | Different layer |
| Combined analysis | Network-layer observations and request contents analysed together in one test. Not implemented or tested. | Exploring |
Shared interest, different layers. NODAL and network privacy projects such as Nym care about the same outcome at different layers. Nym, MetaMask, Reown, WalletConnect, Playwright and GitHub are named only to describe technical areas and compatibility targets. No integration or partnership with any of them has been announced. Names belong to their owners.
NODAL tests only what its scenarios cover. It does not guarantee privacy or detect every leak.
08 · NODAL Privacy Lab · proposed pilot
A proposed, opt-in pilot for dApp teams: NODAL runs one test flow you choose and writes up what it observed. You review it first. Nothing is public unless you approve it. The pilot has not launched; it starts once the Privacy CI workflow exists.
A specific test flow on a test build: for example connect wallet, sign in, request a quote. Test wallets only.
The flow runs in a browser with Playwright. The report shows the data flows observed in that test, with request evidence.
Findings go to your team privately first. You can fix, retest, correct context, or stop.
Publish the approved report, or keep it private. Every report states app version, scenario, evidence and limitations.
Ground rules. Opt-in only. NODAL never publishes a project’s name, logo or results without the team’s explicit permission. A report describes one tested flow on one build. It is not a certification, a privacy score or proof that the app never leaks data.
Planned Not launched. NODAL wants feedback from dApp teams who would try it. Intake opens after the public launch, and how to apply will be posted here.
09 · tokenomics · Planned
After launch, 2% of each taxed trade and a planned share of product revenue are intended to fund $NODAL buybacks. Tokens bought back are intended to be burned.
Buybacks are executed by NODAL on a public schedule with on-chain transactions, not automatically by Pons. Schedule, burn address and the revenue share will be disclosed when finalized. No buyback or burn has happened.
| Allocation | Of each taxed trade |
|---|---|
| Development | 3% |
| Buyback and burn | 2% |
| Total | 5% |
3% pays for development, team and operations. 2% is used to buy $NODAL on a public schedule and send it to a burn address. A share of product revenue is planned to fund further buybacks and burns. Details: $NODAL token · Revenue share
10 · team
The people building Trace Lab, Privacy CI and NODAL’s research.
11 · advisory board
Advisors on privacy engineering, Web3 infrastructure and research.
12 · status