Is Taho safe?
Taho is medium risk. Taho sends PostHog analytics after onboarding, including Analytics Toggled and Chain Added events keyed to a persistent UUID. The shipped SW enables analytics by default on first run and sends dApp connection events with the site's origin.
Who publishes itTaho Doggos - no other listings under this identity
Taho Doggos - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Taho sends wallet analytics to PostHog by default
Taho sends PostHog analytics after onboarding, including Analytics Toggled and Chain Added events keyed to a persistent UUID.
The shipped SW enables analytics by default on first run and sends dApp connection events with the site's origin.
What actually happens
You install and start using the wallet extension.
Connecting a dApp or adding a chain creates wallet activity for the background service.
The extension sends analytics events to PostHog with a persistent identifier.
The source shows dApp connection events include the connected site's origin and chain ID.
Fields assembled for PostHog analytics events
- Persistent analytics ID8ef5023a-6f40-4d3a-bf0f-2ef8f2d91fb9 (illustrative; observed value began 8ef5023a)
Lets the analytics service link multiple wallet events from the same browser profile over time.
- Event nameChain Added
Shows what wallet action happened, such as toggling analytics or adding a chain.
- Connected dApp originhttps://app.uniswap.org (illustrative dApp origin)
Shows which web application your wallet connection was granted to.
- Chain ID1
Shows which blockchain network the wallet action was associated with.
- PostHog project keyphc_<redacted>
Routes the analytics event into Taho's PostHog project.
Captured request
Dynamic analysis observed PostHog capture POSTs for Analytics Toggled and Chain Added events; the evidence text did not record a full request body.
- Accept
- application/json
- Content-Type
- application/json
The code that does this
The service worker enables analytics, builds the payload, and emits dApp connection events
Payload builder and POST request
deobfuscated/background.js:123004-123031function shouldSendPosthogEvents() { return !!"phc_<redacted>";}function createPosthogPayload(personUUID, eventName, payload) { return JSON.stringify({ uuid: esm_browser_v4(), distinct_id: personUUID, api_key: "phc_<redacted>", event: eventName, timestamp: (new Date).toISOString(), properties: { $lib: USE_ANALYTICS_SOURCE, $current_url: typeof window !== "undefined" ? window.location.href : "service-worker", ...payload } });}function sendPosthogEvent(personUUID, eventName, payload) { try { if (shouldSendPosthogEvents()) { fetch(POSTHOG_URL, { method: "POST", body: createPosthogPayload(personUUID, eventName, payload), headers: { "Content-Type": "application/json", Accept: "application/json" } }); } } catch (e) { lib_logger.debug("Sending analytics event failed with error: ", e); }}First-run analytics default
deobfuscated/background.js:123131-123151async internalStartService() { await super.internalStartService(); const {uuid, isNew} = await this.getOrCreateAnalyticsUUID(); let {isEnabled, hasDefaultOnBeenTurnedOn} = await this.preferenceService.getAnalyticsPreferences(); if (!hasDefaultOnBeenTurnedOn) { isEnabled = true; hasDefaultOnBeenTurnedOn = true; await this.preferenceService.updateAnalyticsPreferences({ isEnabled, hasDefaultOnBeenTurnedOn }); await this.emitter.emit("enableDefaultOn", undefined); } if (isEnabled) { browser_polyfill_default().runtime.setUninstallURL(false ? 0 : `${"https://taho.xyz"}/goodbye?uuid=${uuid}`); if (isNew) { await this.sendAnalyticsEvent(AnalyticsEvent.NEW_INSTALL); } } this.#analyticsUUID = uuid;}dApp permission analytics event
deobfuscated/background.js:128675-128686dapp_emitter.on("grantPermission", (async permission => { this.analyticsService.sendAnalyticsEvent(AnalyticsEvent.DAPP_CONNECTED, { origin: permission.origin, chainId: permission.chainID }); await Promise.all(this.chainService.supportedNetworks.map((async network => { await this.providerBridgeService.grantPermission({ ...permission, chainID: network.chainID }); })));}));External destinations used by this analytics path
- app.posthog.com
Receives wallet analytics capture events for Taho's PostHog project.
- taho.xyz
Receives the uninstall URL callback with the persistent analytics UUID when Chrome opens the uninstall survey URL.
