Key-control & disclosure memorandum

MetaMask

The MetaMask memorandum examines how recovery choice, swap routing, telemetry and code licensing qualify a simple ‘self-custody’ description.

Editorial assessment: MetaMask is self-custodial, but self-custody does not mean a single recovery architecture, zero server interaction or universal code openness. Its documentation gives users meaningful choices while requiring careful reading of recovery and privacy settings.

Editorial statusPublished review

Evidence reviewPublic evidence reviewed

Scenario testingScenarios published

ComparisonCategory matrix eligible

Reviewed16 August 2026

Evidence confidencemedium

Suitable for

Who may find this file useful

Users who understand signing risk, can protect recovery material and are willing to choose and document their recovery and telemetry settings.

Primary trade-off

The decision tension

Broad dapp connectivity and recovery options improve reach and convenience while expanding the decisions and dependencies the user must secure.

Research boundary

Documentary, not experiential

Public evidence has been reviewed; account, funding, trading, withdrawal and support scenarios are specified as controlled routes with defined inputs and records.

Evidence-backed strengths

What the record supports

Clear self-custody and recovery documentation
Published repositories and scoped security assessments
User-facing telemetry controls

Material limitations

What must stay qualified

Recovery methods have different online dependencies
Swaps add a documented MetaMask fee plus route costs
Repository visibility does not make every current component permissively open source

Control evidence file4 recorded fields

Key control

MetaMask is self-custodial; users authorise transactions, but service interactions remain part of some features.

documented

Recovery path

Traditional Secret Recovery Phrase and social sign-in recovery use materially different architectures.

documented

Signing and privacy

Dapp requests remain user-approved; security simulation and MetaMetrics can involve service-side data flows.

documented

Software provenance

Extension and mobile repositories are public under restrictive current licences; published assessments are scoped.

documented

Investigative analysis

Claims, records and the gaps between them.

Each conclusion is tied to the primary records immediately below it. Links open the publisher’s original material.

Self-custody describes authority, not isolation

MetaMask describes itself as self-custodial because the user controls the credentials used to sign. That does not imply every feature runs without a service: routing, telemetry and security simulation can communicate with MetaMask or third parties. The useful question is which dependency is active for the chosen action.

Sources: MetaMask Support · MetaMask Support

Recovery choice changes the threat model

Traditional onboarding centres on a Secret Recovery Phrase that can restore the wallet and must remain secret. Newer Google, Apple or Telegram paths use encrypted online shards and a different recovery chain. We do not label one route safer in the abstract; users need to understand the failure and account-compromise conditions of the route they select.

Sources: MetaMask Support · MetaMask Support

A gasless label is not a free transaction

The Swaps guide re-retrieved on 16 August 2026 states a 0.875% MetaMask fee, in addition to network and route-dependent costs. A flow may hide or sponsor a gas payment without eliminating all economic cost. Quote comparisons should therefore include service fee, price impact and execution route.

Sources: MetaMask Support

Privacy depends on settings and feature use

MetaMetrics can collect product events and selected events may be associated with wallet addresses or transaction hashes. Security simulation can send requests to MetaMask or Blockaid services. Users can manage settings, but ‘self-custody’ alone does not prove that no usage data leaves the device.

Sources: MetaMask Support · MetaMask

Visible source code still has a licence boundary

MetaMask maintains public extension and mobile repositories, which improves inspectability. Their current licensing terms are restrictive, so the accurate description is ‘source available for inspection’ rather than universally permissive open source. Published security reviews also apply only to the versions and scopes they name.

Sources: GitHub / MetaMask · GitHub / MetaMask · MetaMask

A support-system breach is not a wallet-key breach

Consensys reported that a 2023 incident affected a third-party customer-support ticketing service and said the MetaMask browser extension and private keys were not compromised. The event remains relevant because support data can aid targeted fraud, but it should not be misreported as compromise of every wallet installation.

Sources: Consensys

Claim → evidence → gap

Ten claims placed under an accountable burden of proof.

Each module keeps the decision consequence beside the evidence and the unresolved gap. Primary material was retrieved on 16 Aug 2026.

Fit

EVM dapp access and active permission management are required.

MetaMask exposes a well-documented self-custody/signing surface.

Fit

The user can protect recovery material and consider hardware-backed keys.

Control stays with the user rather than a support desk.

Not fit

Provider reversal of bad signatures is required.

Confirmed onchain actions may be irreversible.

Not fit

Self-custody must mean zero telemetry or services.

RPC, simulation, swaps and MetaMetrics can create data/service dependencies.

01 / Product claim

Claim under review: Extension and mobile are one observable build.
Evidence on record: Separate repositories and release surfaces exist.
Unresolved gap: Binary provenance for the tested build is not captured.
Decision impact: Fix platform, version and distribution channel first.

Adjacent sources: GitHub / MetaMask · GitHub / MetaMask

02 / Control claim

Claim under review: Self-custody means no external dependency.
Evidence on record: The user controls signing credentials, while some routing, simulation and telemetry use services.
Unresolved gap: Runtime requests are not mapped.
Decision impact: Assess authority and service dependency as two separate claims.

Adjacent sources: MetaMask Support · MetaMask Support

03 / Recovery claim

Claim under review: Every MetaMask wallet has the same recovery path.
Evidence on record: Traditional SRP and newer login/key-share paths have different architectures.
Unresolved gap: The selected path is not tested.
Decision impact: Document compromise and loss conditions for the chosen recovery mode.

Adjacent sources: MetaMask Support · MetaMask Support

04 / Signing-security claim

Claim under review: Warnings make harmful approvals impossible.
Evidence on record: Security programme and user prompts can add simulation/alerts.
Unresolved gap: Permit, blind-sign and hardware-display comprehension remain unobserved.
Decision impact: A controlled malicious-approval test is required.

Adjacent sources: MetaMask

05 / Cost claim

Claim under review: Gasless or in-wallet swaps are free.
Evidence on record: The current guide discloses a MetaMask fee plus route and network economics.
Unresolved gap: Matched executable quotes are absent.
Decision impact: Compare provider fee, price impact, minimum received and gas.

Adjacent sources: MetaMask Support

06 / Funding/exit claim

Claim under review: Built-in purchase or bridge preserves one responsibility chain.
Evidence on record: Third-party/onchain routes can participate.
Unresolved gap: Provider, network and remedy are route-specific and unobserved.
Decision impact: Map every party before using the route.

Adjacent sources: MetaMask Support · MetaMask Support

07 / Permission claim

Claim under review: A connected dapp has harmless access until a transfer.
Evidence on record: Connections, approvals and signatures create distinct authorities.
Unresolved gap: Spending caps and revocation UX are not tested.
Decision impact: Read spender, amount, chain and message before signing.

Adjacent sources: MetaMask

08 / Privacy claim

Claim under review: Self-custody equals anonymity.
Evidence on record: MetaMetrics and security services can process usage, address or transaction data depending on settings.
Unresolved gap: Current network flows are not observed.
Decision impact: Choose features with an explicit data map.

Adjacent sources: MetaMask Support · MetaMask

09 / Support claim

Claim under review: Support can recover lost secrets or reverse a transaction.
Evidence on record: Provider guidance says the SRP must remain secret and self-custody limits recovery.
Unresolved gap: Software/data complaint handling is untested.
Decision impact: Legitimate support must never request the SRP.

Adjacent sources: MetaMask Support · MetaMask Support

10 / Incident/code claim

Claim under review: Public code and no key breach remove operational risk.
Evidence on record: Repositories are inspectable; the 2023 support incident affected data rather than keys.
Unresolved gap: Licences, builds and future support exposure remain bounded.
Decision impact: Distinguish source visibility, binary provenance and support-data risk.

Adjacent sources: GitHub / MetaMask · GitHub / MetaMask · Consensys

Accountable scenario file

What the next observation must record.

Each row specifies a fixed protocol with defined inputs and record.

P-1

Fresh-device recovery

Fixed inputs: Disposable wallet, chosen recovery mode and clean device.

Record: Prompts, account restoration, imported-account boundary and settings.

Published

P-2

Approval comprehension

Fixed inputs: Controlled token/contract, approval and permit, hardware device if supported.

Record: Spender, amount, simulation, device display, reject and revoke.

Published

P-3

Swap and telemetry map

Fixed inputs: Same chain/pair/amount/block window with settings captured.

Record: Fee, gas, minimum received, route and service requests.

Published

P-4

Support impersonation boundary

Fixed inputs: No-value wallet and official support channel only.

Record: Anti-SRP warning, identity request, hand-offs and resolution scope.

Published

Change timeline

Events that change the reading.

1 Apr 2023Support-ticket data incident disclosed.
Identity/support exposure remains distinct from key control.
21 May 2026Current extension release trail visible during review.
Version provenance remains material.
16 Aug 2026Recovery, swaps, telemetry and repositories re-retrieved.
Controlled signing evidence is specified as a fixed protocol output.

Alternatives

When another responsibility model fits better.

Trust Wallet

Broader multi-chain coverage matters more than EVM convention.

Hardware wallet with a narrow companion

Key isolation and a smaller browser surface matter most.

Conclusion control

Medium evidence confidence.

Supported: Recovery, swap and telemetry documents plus repositories support the control-boundary claims.
Gap: Signing, recovery UX, runtime data flow and route costs are unobserved.
What changes the conclusion: Changes to recovery, telemetry defaults, signature presentation or security outcomes would alter the assessment.

Method

How the burden of proof is applied.

Fix build, operating system and recovery mode.
Use disposable accounts with no valuable assets.
Trace transaction authority and data recipients separately.
Compare complete onchain receipts in one block/time window.

Change log

Material file revisions.

16 Aug 2026

Added ten authority/dependency claim files and four safe wallet protocols.

FAQ

Questions that survive the headline.

Can MetaMask recover an SRP?

Not through the traditional SRP route.

Does a hardware wallet stop phishing?

No; it isolates keys but cannot guarantee correct intent.

Are swaps free?

No; provider, route and gas costs can apply.

Does self-custody mean anonymous?

No; enabled services may process address, transaction, device or usage data.

Primary-source register

Reviewed on 16 August 2026 by Candid Ledger Editorial Team; independent editorial review by Candid Ledger Review Team.

Secret Recovery Phrase, password and private keys guide — MetaMask Support · retrieved 16 August 2026
MetaMask is a self-custodial wallet — MetaMask Support · retrieved 16 August 2026
MetaMask Swaps user guide — MetaMask Support · retrieved 16 August 2026
Manage MetaMetrics settings — MetaMask Support · retrieved 16 August 2026
MetaMask browser extension repository — GitHub / MetaMask · retrieved 16 August 2026
MetaMask mobile repository — GitHub / MetaMask · retrieved 16 August 2026
MetaMask security programme — MetaMask · retrieved 16 August 2026
Customer support data security incident FAQ — Consensys · retrieved 16 August 2026