- Public guidance explains keys and recovery
- Telemetry settings and swap fees are disclosed
- Public repositories and scoped security work aid inspection
MM
TRANSACTION CONTROL FILE
MetaMask
A self-custody wallet whose swap routing, telemetry controls and newer recovery paths introduce measurable provider dependencies.
- REVIEW DATE
- EVIDENCE STATUS
- partially verified
- CONFIDENCE
- medium
Written by Beacon Ratio Editorial TeamIndependently reviewed by Beacon Ratio Review TeamPublished by Beacon Ratio Team
EDITORIAL ASSESSMENT
MetaMask gives users transaction-signing authority, but self-custody does not erase routing, telemetry or recovery dependencies. Its swap economics and signing clarity need live, chain-matched tests before comparison.
- SUITABLE FOR
- Users who understand approvals and network fees, and who will actively configure privacy and recovery settings rather than relying on defaults.
- PRIMARY TRADE-OFF
- Broad dapp connectivity and integrated routing reduce friction while increasing the number of providers, permissions and transaction details a user must evaluate.
- New social onboarding differs from a traditional recovery phrase
- Integrated swap cost includes more than gas
- Repository visibility is not proof that a store binary matches source
ANALYSIS / 5
From wallet claim to transaction-control test.
Signing authority
MetaMask describes itself as self-custodial: the user authorises transactions. That does not make every connected dapp, RPC response or approval safe, and it does not make a compromised device recoverable.
Sources: MetaMask is a self-custodial wallet ↗ · MetaMask guide to recovery phrases, passwords and private keys ↗
Recovery variants
Traditional onboarding uses a Secret Recovery Phrase, while newer provider-assisted paths can use encrypted online shards. Those models need separate failure and availability tests.
Sources: MetaMask guide to recovery phrases, passwords and private keys ↗
Swap cost
The Swaps guide reviewed on 15 August 2026 stated a 0.875% MetaMask fee in addition to gas and route-dependent costs. Gasless changes who fronts gas; it does not prove a free trade.
Sources: MetaMask Swaps user guide ↗
Telemetry boundary
MetaMetrics can collect product events and selected events may associate wallet addresses or transaction hashes. A fair test must record defaults, opt-out behaviour and third-party simulation requests.
Sources: Manage MetaMetrics settings ↗
Code evidence
A public extension repository improves inspectability, but current licences and release provenance still matter. Source availability alone cannot prove that installed binaries are reproducible or fully audited.
DECISION FILE / 04
Where this product fits—and where it does not.
Users who understand approvals and network fees, and who will actively configure privacy and recovery settings rather than relying on defaults.
Users unable to protect recovery material, inspect approvals, distinguish gas from service fees, or tolerate public-chain and provider metadata exposure.
Public guidance explains keys and recovery
Trust Wallet offers broader multi-chain positioning and a different privacy/controller record; a hardware wallet can reduce online key exposure but introduces its own firmware and recovery chain.
- REVIEW SCOPE
- MetaMask browser-extension wallet, traditional Secret Recovery Phrase setup, newer social-login recovery, MetaMetrics and integrated swaps. Portfolio, Snaps and every third-party dapp require separate scopes.
- ENTITY / CONTROL BOUNDARY
- The user signs with locally controlled wallet secrets, but recovery configuration, RPC, analytics, simulation and swap routing can add providers. Self-custody is therefore a key boundary, not a claim of zero dependencies.
SCENARIOS / 4
Concrete routes, not generic personas.
Primary decision route
An experienced user creates an empty test wallet, disables optional analytics, compares an integrated swap with a direct venue route, reviews token approvals and rehearses recovery on a clean device.
Integrated swap
Wallet quote → router/aggregator → approval → swap settlement. Open question: Realised price impact, approval gas, failed-transaction cost, MEV exposure and route-provider spread.
Direct dapp route
Wallet connection → direct protocol approval → settlement. Open question: Frontend/provider data exposure, approval scope, failed transaction and later revocation cost.
Alternative route
Trust Wallet offers broader multi-chain positioning and a different privacy/controller record; a hardware wallet can reduce online key exposure but introduces its own firmware and recovery chain.
EXPERT LEDGER / 8
Decision factors with evidence state and the next test attached.
| Decision factor | Current finding and adjacent evidence | Evidence state | Verification protocol |
|---|---|---|---|
| Scope and recovery model | Traditional SRP and social-login recovery use different dependency maps. A verdict must name the setup, version and platform. Sources: MetaMask guide to recovery phrases, passwords and private keys ↗ · MetaMask is a self-custodial wallet ↗ | Documented | Create separate empty-wallet recovery protocols for each setup. |
| Keys and signing | The user controls signing authority, but a malicious approval or compromised device can still authorise irreversible loss. Sources: MetaMask is a self-custodial wallet ↗ · MetaMask guide to recovery phrases, passwords and private keys ↗ | Documented | Inspect decoded intent and revoke test approvals after settlement. |
| Release and simulation | Public source improves inspectability but does not prove a store binary matches a reviewed commit or that every simulation catches malicious intent. | Mixed | Record store version, commit mapping, signature and simulation output for a benign test contract. |
| Legal boundary | A self-custody interface is not a regulated exchange account. Embedded buy, swap or bridge providers can create their own entity and eligibility checks. Sources: MetaMask is a self-custodial wallet ↗ · MetaMask Swaps user guide ↗ | Mixed | Name every counterparty surfaced in the chosen route. |
| Routing and total cost | Integrated swaps combine gas, routing, price impact and a service fee. A headline gas or service fee is not total execution cost. Sources: MetaMask Swaps user guide ↗ | Planned verification | Compare identical token/notional routes with quoted and realised output after all costs. |
| Telemetry and RPC | MetaMetrics can send events to Segment and Mixpanel and associate some actions with addresses or transaction hashes; participation depends on onboarding and settings. Sources: Manage MetaMetrics settings ↗ | Documented | Observe network requests with analytics on and off, without exposing real balances or secrets. |
| Support and recovery disputes | Support cannot reconstruct a traditional SRP. Social recovery adds account and server dependencies that need their own failure rehearsal. Sources: MetaMask guide to recovery phrases, passwords and private keys ↗ · MetaMask is a self-custodial wallet ↗ | Mixed | Rehearse clean-device recovery and document what support can and cannot change. |
| Permissions and change control | Extension updates, RPC defaults, telemetry and transaction simulations can alter the control surface between reviews. Sources: MetaMask browser extension repository ↗ · Manage MetaMetrics settings ↗ | Mixed | Diff release, defaults and permission prompts before each published update. |
TOTAL COST / 2
Fee schedules are inputs, not outcomes.
| Scenario | Route | Documented inputs | Open question |
|---|---|---|---|
| Integrated swap | Wallet quote → router/aggregator → approval → swap settlement | Displayed service fee, estimated gas and quoted output. Sources: MetaMask Swaps user guide ↗ | Realised price impact, approval gas, failed-transaction cost, MEV exposure and route-provider spread. |
| Direct dapp route | Wallet connection → direct protocol approval → settlement | Protocol quote and network gas. Sources: MetaMask is a self-custodial wallet ↗ · Manage MetaMetrics settings ↗ | Frontend/provider data exposure, approval scope, failed transaction and later revocation cost. |
How this file becomes a measured result
Use empty wallets and fixed chain conditions. Record build provenance, recovery model, RPC and analytics settings, decoded transaction, approvals, quote route, gas, service fee, price impact and final on-chain state.
What the documents can support
Medium-high for documented self-custody and analytics behaviour; medium for public code visibility; insufficient for shipped-build equivalence, live routing quality, simulation accuracy and recovery success.
Conclusion-change gates
- Recovery defaults or MetaMetrics collection change.
- A reproducible build or signed provenance process materially improves release assurance.
- Live chain-matched tests establish persistent routing, approval or privacy differences.
CHANGE LOG / 03
Evolution stays visible.
Rechecked self-custody, MetaMetrics and repository surfaces; added approval, routing and recovery scenarios.
Opened the wallet execution file without a numeric rating.
Recovery defaults or MetaMetrics collection change. A reproducible build or signed provenance process materially improves release assurance. Live chain-matched tests establish persistent routing, approval or privacy differences.
FAQ / 4
Questions that change the decision.
Does self-custody mean MetaMask sees no data?
No. Keys remain local, but analytics, RPC and embedded services can still process usage and public-chain identifiers.
Can support restore a lost traditional SRP?
The official self-custody guidance says MetaMask cannot recover it. Social-login recovery is a different setup.
Has the shipped extension been reproduced here?
No. Source and product documents were reviewed; build equivalence is planned.
What would change this conclusion?
Recovery defaults or MetaMetrics collection change.
5 records reviewed
Provider pages establish provider statements. Terms, filings and regulator records retain their narrower legal or historical scope. Dynamic sources were retrieved on 16 August 2026.
- productRetrieved 2026-08-16MetaMask guide to recovery phrases, passwords and private keys ↗
- productRetrieved 2026-08-16MetaMask is a self-custodial wallet ↗
- productRetrieved 2026-08-16MetaMask Swaps user guide ↗
- productRetrieved 2026-08-16Manage MetaMetrics settings ↗
- technicalRetrieved 2026-08-16MetaMask browser extension repository ↗