A researcher who found evidence of data harvesting inside Ledger Live has revealed equally disturbing harvesters inside MetaMask and Avalanche browser extensions.

MetaMask, the world’s most popular crypto wallet, uses a single pixel (‘1X1’) iFrame to embed trackers into its browser extension. The Ethereum- and ConsenSys-backed extension contains a data harvesting ‘analytics_iFrame’ within its code.

For context, the iFrame is an old trick by web marketers. Publishers would secretly serve ad code inside an iFrame displayed as one, invisibly small pixel — tolling untold profits through invisible ad impressions. Due to years of iFrame abuse, many web browsers and advertising platforms ban iFrames altogether.

However, MetaMask still uses an invisible iFrame — perhaps hoping that no one would have thought to look through its outdated bits of CSS code. The iFrame within the browser extension circumvents traditional web safety services because the user voluntarily installs the extension and approves its permissions.

Naturally, MetaMask requires new users to agree to its terms of use. It vaguely disclaims responsibility for third-party content and services — without specifically naming iFrame trackers, of course.

“You access, rely upon, or use any third-party content or third-party service at your own risk. Consensys disclaims all responsibility and liability for any losses on account of your reliance upon or use of such content or services.”

MetaMask’s terms do not clarify whether these third-party offerings include data harvesting or code hidden within iFrames.

Another data harvesting operation: Avalanche

The same researcher who exposed data harvesting inside Metamask and Ledger Live also revealed concerning web extensions in another crypto wallet: Avalanche.

Avalanche added analytics code to its Core App Chrome extension. Avalanche used to make all its code open source. However, at some point, it changed its licenses. The analytics portion of Avalanche’s extension is not open source.

Read more: Researcher finds data harvesting inside Ledger Live app

Data harvesting includes transaction data, mouse clicks, and other actions users take while using Avalanche’s wallet browser extension and its token, AVAX.

Naturally, researcher REKTbuildr questioned why these web extensions, which also serve as crypto wallets for millions of people, need to use analytics trackers at all.

As with REKTbuildr’s critique of Ledger Live, the researcher expects that Avalanche allows transmission of anonymized audience data to internal UI/UX teams or third-party advertisers.

Got a tip? Send us an email or ProtonMail. For more informed news, follow us on X, Instagram, Bluesky, and Google News, or subscribe to our YouTube channel.

The post Data harvesting found in MetaMask, Avalanche web extensions appeared first on Protos.

Upstart blockchain Fantom (FTM) overtook rival Avalanche (AVAX) in daily transaction count once more in the first week of 2022. Both are popular networks for decentralized finance (DeFi).

Fantom’s daily transaction count eclipsed Avalanche’s in the first few days of the year, reported Delphi Digital, with its lead growing over the past few days.

Avalanche led Fantom in transaction count for some of 2021’s fourth quarter, but on Thursday:

• Fantom processed 853,422 transactions.
• Avalanche saw 737,200 transactions
• Ethereum processed 1.21 million transactions, about 40% more than Fantom.

FTM’s market capitalization has doubled over the last 30 days alone. The $9-billion protocol now has $5.77 billion in total value locked (TVL), a popular albeit misleading measure of DeFi popularity.

Many attribute the surge in Fantom usage to a series of endorsements by Avalanche core developer Daniele Sestagalli.

Almost 45% of Fantom’s TVL was kept in token bridge Multichain at press time.

Fantom’s older competitor, Avalanche, has slid in value 16% over the past seven days to a $22-billion market capitalization.

Avalanche also hosts third-party DeFi apps like liquidity protocols Aave and Spell, and decentralized exchanges Pangolin and Trader Joe.

At current prices, users have locked $11 billion worth of AVAX into its DeFi protocols. Lending platform Aave is the most dominant on Avalanche, currently managing 25% of its TVL, according to DeFi Llama.

Celebrity DeFi devs drive Fantom interest

Fantom describes itself as a low-cost blockchain for launching decentralized applications (dapps) with Ethereum compatibility.

The 80-plus dapps launched on Fantom include NFT marketplaces Artion, ZooCoin, and PaintSwap; and decentralized exchanges Spooky Swap, Curve, and Morpheus Swap.

New projects launching on Fantom are driving its momentum. Sestagalli and his confidante, Yearn Finance’s Andre Cronje, announced on Thursday they intend to launch a new token on Fantom.

The duo created TIME, SPELL, ICE, and MIM — Avalanche tokens with a $6-billion combined market cap.

FTM holders can stake their tokens to earn yield. FTM stakers can earn APY of up to 13% and auto-compound rewards.

Fantom also enables the staking of stablecoins with APRs between 30% and 60%, which Delphi Digital’s Joo Kian reckons has helped attract users of late.

Another fledgling multi-chain DeFi protocol, Hundred Finance, is also gaining traction with its new, Fantom-based Voting Escrow Token (“ve-token”) to help stakers manage voting power.

In November 2021, Fantom reported significant growth from its FTM Incentive Program, including a 600% increase in TVL, and a 300% increase in daily transactions and active users since its announcement last August.

Fantom recently made some of its code open-source and offers APIs and oracles for dapp developers.

The blockchain’s official wallet includes synthetic assets that represent crypto assets outside of the Fantom ecosystem.

This feature relies on price oracles and Fantom’s native “fSwap” exchange. Users can also use “fLend” to loan and borrow FTM and Fantom’s native stablecoin, fUSD.

High yield, ultra-high risk

Risks of DeFi platforms like Avalanche and Fantom include unaudited code, exploitable bugs, insufficient risk disclosures, aggressive marketing tactics, and occasional exit scams.

Fantom dubiously claims that its “Lachesis” consensus algorithm is superior to Bitcoin’s Nakamoto consensus.

The project states that its algorithms are Byzantine fault tolerant, allegedly enabling it to withstand attacks by malicious or faulty nodes comprising up to one-third of its network.

For its part, Avalanche brags its testnet can support up to 4,500 transactions per second across thousands of pruned nodes.

However, Avalanche’s mainnet currently processes around 10 transactions per second, according to SnowTrace (Ethereum handles around 14 per second, Fantom under six).

The primary allure of DeFi protocols are their high yields. Positioned as an alternative to traditional bank accounts, these platforms advertise annualized yields on tokens with double-digit percentages.

Aggressive protocols advertise triple-digit and even higher yields while burying the risk of default within terms of service documents.

Read more: [Terra starts year as top-two DeFi ecosystem, beating Binance Smart Chain]

As a factor of the “traditional finance” 0.09%, risk-free interest rate, DeFi’s high-yield products are hundreds, thousands, or even millions of times more likely to default than a bank account.

Forensic security company Chainalysis reports that orchestrators of rug pulls and DeFi exploits stole $3.2 billion in 2021.

Chainalysis cites the lack of code audits across DeFi as a significant factor in at least 68% of those losses, amounting to at least $2.2 billion.

Follow us on Twitter for more informed crypto news.

Edit 11:50 UTC, Jan 9: Corrected millions to billions in final paragraph.

The post Ethereum wannabes Fantom, Avalanche duke it out over transaction count appeared first on Protos.