Is Casper Wallet safe?
Casper Wallet sends visited merchant URLs and the active wallet public key to api.bringweb3.io for its BringWeb3 integration.
Casper Wallet includes a BringWeb3 integration that checks visited merchant pages against remote configuration from api.bringweb3.io. When a matching page is processed, it sends the page URL, merchant domain, extension metadata, a persistent user ID, and the active Casper wallet public key to that service.
Who publishes itMAKE Technology LLC - no other listings under this identity, 2 shared hostnames
MAKE Technology LLC - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Casper Wallet reports every site you visit and your wallet key to BringWeb3
When you visit a merchant on BringWeb3's own domain list, Casper Wallet's background script reports the exact page URL and a persistent install ID to api.bringweb3.io, and attaches your Casper public key if your wallet is unlocked.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate a tab to a domain that appears on BringWeb3's own server-supplied merchant list.
The content script runs on every http(s) page in every frame from page load, so the check happens on every navigation.
The background script reports the exact page URL, a persistent install ID, and your Casper wallet public key (if unlocked) to api.bringweb3.io.
This runs whether or not you interact with the cashback popup; the report happens on the navigation alone.
- Page you visitedhttps://www.justanswer.com/pricing
The exact URL tells BringWeb3 which merchant page you are on right now.
- Persistent install IDfc787ab0-fb92-4a2c-afc4-2cf4cf3b643a
A UUID generated once and reused on every report, tying all your visits to the same install.
- Casper wallet public key02ddc3b66a556cdd9f1d742844300ef698f723ea246be7fbe080b9a376fece52a4 (illustrative format; no wallet was unlocked during this test session)
Attached automatically by the shared request code whenever your wallet is unlocked in this browser.
- Visit phasenew
Marks whether this is a first-seen visit or a return visit for BringWeb3's own funnel tracking.
302 redirect to extension.bringweb3.io carrying a signed token; the same request pattern repeated verbatim for udemy.com, shopify.com and nordvpn.com with each request's own visited URL
{ "phase": "new", "url": "https://www.justanswer.com/pricing", "matches": [ { "match": [ "moc.rewsnatsuj/pricing", "moc.rewsnatsuj" ], "type": "d" } ], "version": "1.6.4", "optOut": 0, "userId": "fc787ab0-fb92-4a2c-afc4-2cf4cf3b643a"}The redirect BringWeb3 sends back after a merchant visit carries a token that decodes to the matched retailer's name and cashback rate, confirming the visited URL drove per-merchant attribution.
{ "retailerId": "10192b10-d567-a2ed-e46e-6f0db690082c.00", "name": "NordVPN", "maxCashback": "24.000"}The shared request helper splices your wallet key into every POST body
sendBringWeb3Request = async ({ path, method, params, timeout }) => { if (!path || !method || (!params && method === "POST")) { throw new Error("Missing endpoint or method"); } const config = BringWeb3Config.getInstance(); const baseDomain = config.getBaseDomain(); // "https://api.bringweb3.io" const apiPath = config.getApiPath(); const envName = await getStorageValue("envName"); let requestUrl = envName ? `${baseDomain}/${envName}/${apiPath}${path}` : `${baseDomain}/${apiPath}${path}`; const apiKey = config.getApiKey(); if (method === "GET") { requestUrl += `?${new URLSearchParams({ ...params, version: getVersion(), timestamp: Date.now().toString(), opt_out: await getStorageValue("optOut") || 0, user_id: await getOrCreateInstallId() || "undefined", wallet_address: await getStorageValue("walletAddress") || "undefined" })}`; } else if (method === "POST") { // The caller (e.g. reportVisit -> POST /check/popup) only passes // {domain, phase, url} -- walletAddress is spliced in here, from the // in-memory value or straight out of chrome.storage.local, whether // or not the caller asked for it. params = { ...params, version: getVersion(), timestamp: Date.now(), optOut: await getStorageValue("optOut") || 0, userId: await getOrCreateInstallId() || undefined, walletAddress: params?.walletAddress || await getStorageValue("walletAddress") || undefined }; } return await (await fetch(requestUrl, { method, headers: { "Content-Type": "application/json", "x-api-key": apiKey }, body: method === "POST" ? JSON.stringify(params) : undefined, signal: timeout ? AbortSignal.timeout(timeout) : undefined })).json();}- api.bringweb3.io
BringWeb3's cashback/affiliate-tracking backend; receives the visited URL, the persistent install ID, and the wallet key when unlocked.
- extension.bringweb3.io
Receives the post-report redirect carrying a signed token that names the matched retailer and cashback rate.
Where it sends data
Destinations our analysis observed Casper Wallet contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.bringweb3.io
Casper Wallet sends data to api.bringweb3.io. 2 other extensions we have analysed send data here.