Is ZKX Web3 Wallet safe?

Medium risk

ZKX Web3 Wallet sends a persistent instance ID and selected account address/balance to Ambire price requests.

Its background fetch wrapper adds x-app-source and x-app-version headers to ambire.com requests when a keystore ID exists. For cena.ambire.com price requests, it also appends the current account address and stored balance as a panVal URL parameter.

LibertySwap Developerv0.0.50Chrome Web Store
45Risk
Who publishes it

LibertySwap Developer - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
LibertySwap Developer
Website
x.com/LibertySwapFi

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Wallet price requests include instance ID and account details.

When you use ZKX Web3 Wallet, its wallet backend request wrapper adds a persistent extension instance ID to Ambire requests.

For Ambire price requests, it can also append the selected account address and balance to the request URL.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You take a wallet action that causes Ambire pricing data to be requested.

The extension did this

The wallet request wrapper adds a persistent instance ID to Ambire requests and can append the selected account address and balance to Ambire price request URLs.

Captured request
GEThttps://cena.ambire.com/api/v3/simple/price
Fields in the request
  • Wallet storage data
    d7f3a1b2-... (illustrative)

    Used to derive a persistent instance ID that can link Ambire requests from the same wallet installation.

  • Request headers
    x-app-source: d7f3a1b2-... (illustrative)

    Carries the derived instance ID and app version on Ambire requests.

  • Request URL
    panVal={"a":"0x1234...","b":0} (illustrative)

    Can include a query value containing the selected account address and balance on Ambire price requests.

Observation

Dynamic analysis confirmed the wrapper adds the persistent instance ID to Ambire requests and appends selected account address and balance data for Ambire price requests when the selected account has keys.

Where it sends data

Destinations our analysis observed ZKX Web3 Wallet contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ambire.com

    ZKX Web3 Wallet sends data to ambire.com. No other extension we have analysed sends data here.

  • cena.ambire.com

    ZKX Web3 Wallet sends data to cena.ambire.com. No other extension we have analysed sends data here.

Updated 30 September 2026fibfaangghabdbndamiaceoahiajfgck