CITT

    Scan results

    MetaMask: Trade Crypto

    Android

    MetaMask is the world's most secure and flexible crypto wallet. Trusted by over 100 million users to buy, sell, and swap digital assets, our industry-leading security protects every move you make.

    CITT SCORE
    85
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Crypto users comfortable with standard analytics

    What It Means For You

    Usage patterns and app events are shared with Segment Analytics and Sentry for behavioral tracking and crash reporting. Branch.io receives data to attribute how the app was discovered, while Firebase Messaging handles notifications. Veriff may process identity documents if any built-in verification features are used.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    3 total
    2 Medium
    1 Low

    Network Security

    3 total
    3 Low

    Code Security

    2 total
    1 Medium
    1 Info

    Privacy

    1 total
    1 Medium

    Third-Party Risk

    4 total
    4 Info

    Third-Party Services

    Sentry, Branch.io, Firebase Messaging, Firebase Installations, Veriff, Segment Analytics, Google ML Kit, WalletConnect (Yttrium), QuickNode

    Security Strengths

    • ✓Wallet vault private keys are encrypted at the JS layer before being written to AsyncStorage — key material is not stored in plaintext
    • ✓Android Keystore-backed encryption used for primary react-native-keychain cipher (KeystoreAESGCM)
    • ✓Firebase Messaging auto-init disabled (manual initialization only)
    • ✓Expo OTA updates disabled at launch
    • ✓Google ML Kit processes barcode and face detection locally with no data transmitted to Google
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    crypto wallet

    Package

    io.metamask

    Version

    7.71.0 (versionCode 4199)

    Analysis Date

    Apr 8, 2026

    Classes Analyzed

    1,200

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 3 findings (2 medium, 1 low)

    Network Security - 3 findings (3 low)

    Code Safety - 0 findings

    Privacy - 1 finding (1 medium)

    Privacy Concerns

    What Data is Collected

    MetaMask collects behavioral and usage data through Segment Analytics and crash data through Sentry. Firebase Installations registers the device for notification delivery. Branch.io collects referral data to understand how the app was discovered.

    Third-Party Data Sharing

    ServicePurpose
    Segment AnalyticsBehavioral tracking and usage analytics
    SentryCrash reporting and error monitoring
    Branch.ioAttribution and referral tracking
    Firebase MessagingPush notification delivery
    Firebase InstallationsDevice registration
    VeriffIdentity verification (if used)
    Google ML KitOn-device processing
    WalletConnect (Yttrium)Wallet connection protocol
    QuickNodeBlockchain network access

    Understanding the Scores

    CategoryScore
    Security86/100
    Privacy84/100
    Data Security70/100
    Network Security94/100
    Code Safety90/100
    Data Collection94/100
    Data Sharing96/100
    User Control93/100

    Positive Security Features

    • Network communications are well-protected, reflected in a 94/100 Network Security score.
    • Data sharing with third parties is highly selective, with a 96/100 Data Sharing score indicating tight controls on what leaves the app.
    • User control options score 93/100, offering meaningful choices about data.
    • Code safety practices rate at 90/100, reflecting responsible engineering standards.

    Areas for Improvement

    • Local data storage practices scored 70/100, the lowest area in this report. Stronger protections for data stored on the device would raise confidence in this area.
    • A small number of medium-priority privacy and data handling issues were identified that a future update could address.
    • Analytics data collection is active by default. Reviewing the app's privacy settings may provide additional control over behavioral data sharing.

    About This Analysis

    This report was generated by canITrustThat using automated static analysis of the published app.

    App Details

    • App: MetaMask - Crypto Wallet
    • Package ID: io.metamask
    • Version: 7.71.0 (build 4199)
    • Platform: Android
    • Analysis Date: 2026-04-09

    Right of Reply

    Developer not yet contacted