Is Taho safe?

Medium risk

Taho is medium risk. Taho sends PostHog analytics after onboarding, including Analytics Toggled and Chain Added events keyed to a persistent UUID. The shipped SW enables analytics by default on first run and sends dApp connection events with the site's origin.

Taho Doggosv0.67.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Taho sends wallet analytics to PostHog by default

Taho sends PostHog analytics after onboarding, including Analytics Toggled and Chain Added events keyed to a persistent UUID.

The shipped SW enables analytics by default on first run and sends dApp connection events with the site's origin.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install and start using the wallet extension.

Connecting a dApp or adding a chain creates wallet activity for the background service.

The extension did this

The extension sends analytics events to PostHog with a persistent identifier.

The source shows dApp connection events include the connected site's origin and chain ID.

02EvidenceFIELD TABLE
Fields assembled for PostHog analytics events
FieldValueWhy it matters
Persistent analytics ID
8ef5023a-6f40-4d3a-bf0f-2ef8f2d91fb9 (illustrative; observed value began 8ef5023a)Lets the analytics service link multiple wallet events from the same browser profile over time.
Event name
Chain AddedShows what wallet action happened, such as toggling analytics or adding a chain.
Connected dApp origin
https://app.uniswap.org (illustrative dApp origin)Shows which web application your wallet connection was granted to.
Chain ID
1Shows which blockchain network the wallet action was associated with.
PostHog project key
phc_<redacted>Routes the analytics event into Taho's PostHog project.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://app.posthog.com/capture/
Dynamic analysis observed PostHog capture POSTs for Analytics Toggled and Chain Added events; the evidence text did not record a full request body.
Headers
Acceptapplication/json
Content-Typeapplication/json
04EvidenceCODE COMPARE
The code that does this

The service worker enables analytics, builds the payload, and emits dApp connection events

What it actually does
Payload builder and POST requestdeobfuscated/background.js:123004-123031
function shouldSendPosthogEvents() {
  return !!"phc_<redacted>";
}
function createPosthogPayload(personUUID, eventName, payload) {
  return JSON.stringify({
    uuid: esm_browser_v4(),
    distinct_id: personUUID,
    api_key: "phc_<redacted>",
    event: eventName,
    timestamp: (new Date).toISOString(),
    properties: {
      $lib: USE_ANALYTICS_SOURCE,
      $current_url: typeof window !== "undefined" ? window.location.href : "service-worker",
      ...payload
    }
  });
}
function sendPosthogEvent(personUUID, eventName, payload) {
  try {
    if (shouldSendPosthogEvents()) {
      fetch(POSTHOG_URL, {
        method: "POST",
        body: createPosthogPayload(personUUID, eventName, payload),
        headers: {
          "Content-Type": "application/json",
          Accept: "application/json"
        }
      });
    }
  } catch (e) {
    lib_logger.debug("Sending analytics event failed with error: ", e);
  }
}
First-run analytics defaultdeobfuscated/background.js:123131-123151
async internalStartService() {
  await super.internalStartService();
  const {uuid, isNew} = await this.getOrCreateAnalyticsUUID();
  let {isEnabled, hasDefaultOnBeenTurnedOn} = await this.preferenceService.getAnalyticsPreferences();
  if (!hasDefaultOnBeenTurnedOn) {
    isEnabled = true;
    hasDefaultOnBeenTurnedOn = true;
    await this.preferenceService.updateAnalyticsPreferences({
      isEnabled,
      hasDefaultOnBeenTurnedOn
    });
    await this.emitter.emit("enableDefaultOn", undefined);
  }
  if (isEnabled) {
    browser_polyfill_default().runtime.setUninstallURL(false ? 0 : `${"https://taho.xyz"}/goodbye?uuid=${uuid}`);
    if (isNew) {
      await this.sendAnalyticsEvent(AnalyticsEvent.NEW_INSTALL);
    }
  }
  this.#analyticsUUID = uuid;
}
dApp permission analytics eventdeobfuscated/background.js:128675-128686
dapp_emitter.on("grantPermission", (async permission => {
  this.analyticsService.sendAnalyticsEvent(AnalyticsEvent.DAPP_CONNECTED, {
    origin: permission.origin,
    chainId: permission.chainID
  });
  await Promise.all(this.chainService.supportedNetworks.map((async network => {
    await this.providerBridgeService.grantPermission({
      ...permission,
      chainID: network.chainID
    });
  })));
}));
05EvidenceTHIRD PARTY LIST
External destinations used by this analytics path
  • app.posthog.com

    Receives wallet analytics capture events for Taho's PostHog project.

  • taho.xyz

    Receives the uninstall URL callback with the persistent analytics UUID when Chrome opens the uninstall survey URL.

Updated 17 September 2026eajafomhmkipbjmfmhebemolkcicgfmd