PRIVACY · UPDATED 2026-11-02
Your addresses, your choice
No wallet connection. No signatures. The scan runs in your browser and makes read-only requests to public services.
What you enter
Public EVM or Solana addresses, or ENS names, up to 10 at a time. ENS names are resolved through Ethereum RPC providers before the protocol checks start. Repeated wallets are scanned once.
Who receives requests
- Public RPC providers: your browser asks the providers listed in the engine's network configuration for contract state and balances on every EVM network the scanner reads. These requests can contain your address and related smart accounts.
- DefiLlama (coins.llama.fi): receives token contract identifiers to estimate USD values and gas costs. The scanner does not send your wallet address to its price API.
- Hyperliquid: its public API receives your address to look for perpetual, spot, staking and vault balances.
- Merkl: its public API receives your address to look for unclaimed rewards.
- GitHub's raw content service: your browser downloads Uniswap's published claim index and the relevant block of allocations. These file requests do not contain your complete wallet address.
- Our proxy: receives addresses in POST request bodies for zkSync Lite, Safe and Solana. It asks zkSync Lite's eligibility API, Safe's transaction service or Helius's Solana RPC on your behalf. Local development without a Helius key uses Solana's public mainnet RPC. Safe also receives the addresses of any Safes whose balances are read.
Direct providers see your IP address and can see which addresses you query together. Our proxy also sees your IP address and the submitted addresses. Its upstream services see requests from the proxy. Those providers have their own retention policies.
Scanning several wallets can link them
RPC providers and our proxy see addresses scanned together from the same IP. That can link wallets you prefer to keep separate, including wallets used for airdrops. Scanning one wallet at a time avoids this grouping. When you enter several addresses, the scanner shows this warning near Scan. It informs you without requiring an extra click.
What the site never stores
Addresses, ENS names and results stay in the current page's memory. They are never added to the site's URL, cookies, local storage or a database. Reloading the page or using the clear button removes them from the app. Your browser and its extensions may have their own behavior.
The app does not use cookies or persistent browser storage to keep your scan. Web analytics and the planned anonymous scan counter are not installed. Cloudflare provides the security checks described below, with its own challenge metrics. Fonts are served from this site.
Browser verification with Cloudflare Turnstile
After you submit valid inputs, Turnstile checks your browser before the scan uses our proxy. Your browser contacts challenges.cloudflare.com, so Cloudflare receives your IP address and browser information. It runs small background checks to collect signals about your browser environment and distinguish people from automated traffic. Cloudflare says Turnstile does not access, store or transmit form entries, communications or other page inputs.
We send no wallet address, ENS name or scan result to Turnstile. Our proxy sends only its verification secret and Turnstile's temporary token to Cloudflare's validation service. It does not forward your IP address in that validation request. Cloudflare already receives it through the browser check. Usually the check runs without interaction; Cloudflare may ask you to select a checkbox. There are no image or text puzzles.
Turnstile's optional pre-clearance feature can set a cf_clearance cookie. We keep that feature disabled. Our scan pass is a random identifier and an expiry, signed by our proxy, valid for two minutes and kept only in this page's memory. It contains no wallet address or IP address. We do not log or store verification tokens or passes. The same temporary pass accompanies the proxy requests in a scan, so those requests can be associated while they are being processed.
Read how Cloudflare Turnstile worksand its Turnstile Privacy Addendumfor more information. If verification is blocked, fails or expires, we show a message and proxy checks are reported as not checked. Other checks can still return results.
How the proxy handles data
The proxy does not log addresses, IP addresses, verification tokens or scan passes. Automatic invocation logs and outgoing request traces are disabled. It uses IP addresses for rate limiting. It caches validated eligibility and Safe balance responses for 10 minutes under hashed request keys. Responses can contain public balances and contract addresses. Lists of Safes owned by a wallet are never cached. Solana account responses are never cached either.
If the proxy is not configured or is unavailable, its checks report a failure. Other checks can still return findings.
Avoid address poisoning
Always copy addresses from your own wallet, never from a transaction history, and compare them in full. Attackers can place lookalike addresses in your history. Check the official domain before following a recovery guide.
What a scan can tell you
A scan covers only the catalog's supported protocols and markets. A failed or partial check is not evidence that a wallet has nothing. Values and claim costs are estimates. Follow the linked guide and verify the official app before taking action there.
The site never asks for a private key, seed phrase, wallet connection or signature, and it never sends transactions.
Protocol names and logos
Protocol names and logos belong to their respective owners. They are used only to identify the protocol and imply no affiliation or endorsement. They are excluded from the MIT and CC BY 4.0 licenses. Logos in scan reports are served from this site, without requests to the brands.