trenchcoat
Free · no sign-up
Website report · 3 h ago

nullmask.io

“Make any wallet and any transaction private — in one click.”

Template-written 31 evidence items Code reader analysed 18 scripts
What this means for you

nullmask.io talked to 2 outside services on a first visit, including 2 that measure visits or show ads.E6E5

  • An AI agent used the site and saw 2 of 3 claimed features working.E27E28E29E30E31E22
  • Trading / swaps / bots: On the app's Swap page, I picked the 500 USDT preset. The page made an Ethereum RPC call and showed a live quote: 1 ETH = 2,101.87 USDT, a price impact under 0.01%, slippage options and an ETH amount to pay. Actually running the swap, and the automated bridging and routing, need a connected wallet and could not be tested.E27E28
  • Own chain / L2 / ZK: I read the docs welcome, roadmap and 'What stays private' pages. They describe a shared shielded pool and a relayer, but they say nothing about Turing-complete spending scripts or zero-knowledge account abstraction, and the roadmap doesn't list either one. No ZK feature could be seen working from the browser.E29E30E31
  • A working app / platform: 'Open app' loaded app.nullmask.io with Shield, Send, Swap, Bridge, Analytics and Points pages. The Analytics page fetched /api/analytics and showed live-updating numbers (marked 'Live · 15 s ago'). Shielding, sending and withdrawing all need a connected wallet.E22E25E26E27
  • Tech check: the site claims a working app / platform, and its public page shows matching evidence.E19E14
  • Tech check: the site mentions trading / swaps / bots and own chain / l2 / zk, but we found nothing behind those in what its public page loads.E17E18
  • Before you click anything, the page loads analytics or ad services: Google Analytics / Tag Manager.E6E5
  • 4 cookies were set in your browser, all by the site itself.E7E8E9

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Nothing found on the public page

Trading / swaps / bots

“…count abstraction. Automated privacy workflows: Handle swaps, bridging, and routing to maximize privacy without use…”E17

No matching code, calls or services in what loaded for us.

Nothing found on the public page

Own chain / L2 / ZK

“…e privacy: Enable Turing-complete spending scripts and zero-knowledge account abstraction. Automated privacy workflows: Hand…”E18

No matching code, calls or services in what loaded for us.

Evidence found

A working app / platform

“…es Next wave in Live Leaves at 07:15 Your time · GMT+0 Open app MASK HuAXPy…CUa7 Buy Nullmask has solved the everlasti…”E19

Calls to its own backend: /api/wavesE14

Calls its own backend /api/wavesE14
Wallet code none seen
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

The real tech may live elsewhere. This page links to: app.nullmask.io · check the app

What the AI agent tried

An AI agent (claude-opus-5-5) used the site in our sandbox for 11 steps and saw 2 of 3 claimed features working. It can't connect a wallet, pay, sign or log in, so those features count as "couldn't test". What it reports is what it observed, not a verdict.

Seen working

Trading / swaps / bots

On the app's Swap page, I picked the 500 USDT preset. The page made an Ethereum RPC call and showed a live quote: 1 ETH = 2,101.87 USDT, a price impact under 0.01%, slippage options and an ETH amount to pay. Actually running the swap, and the automated bridging and routing, need a connected wallet and could not be tested.E27E28

Not seen working

Own chain / L2 / ZK

I read the docs welcome, roadmap and 'What stays private' pages. They describe a shared shielded pool and a relayer, but they say nothing about Turing-complete spending scripts or zero-knowledge account abstraction, and the roadmap doesn't list either one. No ZK feature could be seen working from the browser.E29E30E31

Seen working

A working app / platform

'Open app' loaded app.nullmask.io with Shield, Send, Swap, Bridge, Analytics and Points pages. The Analytics page fetched /api/analytics and showed live-updating numbers (marked 'Live · 15 s ago'). Shielding, sending and withdrawing all need a connected wallet.E22E25E26E27

Also noticed

Things the agent saw along the way that aren't among the site's claims. Not counted above.

Noticed

Analytics dashboard figures

The Analytics page showed $137.9M total volume since Oct 1, 2026, $1,661,411 total revenue and a 40-day daily table. It says the data is computed from pool contract events across 8 chains and links to Dune so the numbers can be checked; I did not check them against Dune.E26

Noticed

Docs on privacy limits

The 'What stays private' docs page says deposit addresses and amounts, and withdrawal recipients and amounts, are public on-chain. It also says the operator can see user activity and that Nullmask does not promise activity can never be linked.E31

What it is

  • The Internet Archive first saved this site on 2025-11-06 (368 days ago).E20
  • The site describes itself as: “NullMask is a private VPN for crypto: confidential transfers, swaps and bridging for tokens and stablecoins on Ethereum and Base. One click.”E2
  • It's built with Svelte / SvelteKit (common tools for building web apps).E10
  • In your browser it can copy text to your clipboard.E12
  • While loading, it called 1 endpoint on its own servers, such as /api/waves.E14

Where your data goes

Analytics & trackingCount visits and record what you do on the page. 2
www.google-analytics.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 2×E6
www.googletagmanager.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 2×E5

How key features work

Loading its content

Its content loads from its own API while you browse (/api/waves).E14

/api/waves

Drawing and editing in the browser

The page draws and edits graphics in your browser using the canvas.E13

canvas

Measuring what you do

Visits and clicks are measured with Google Analytics / Tag Manager and Google tag (gtag.js) (found in its traffic or its code).E6E5E11

Google Analytics / Tag ManagerGoogle tag (gtag.js)

Cookies and storage

Names only. We never store the values.

CookieSet forKeptWhose
__vdplE7nullmask.io until you close the browserthe site
__vdplE7nullmask.io until you close the browserthe site
_gaE8nullmask.io about 400 daysthe site
_ga_R7WC64N31NE9nullmask.io about 400 daysthe site

Pages and API calls

Pages it links to

/

Endpoints

Called while loading (seen) or named in the code (code).

nullmask.io/api/wavesseenE14
/api/wavescodeE15

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: Make any wallet and any transaction private — in one click.
page title · https://nullmask.io/
E2
Page description: NullMask is a private VPN for crypto: confidential transfers, swaps and bridging for tokens and stablecoins on Ethereum and Base. One click. Any walle
page description · https://nullmask.io/
E3
Main heading: One Click. Total Privacy.
page h1 · https://nullmask.io/
E4
28 request(s) to nullmask.io
types: 16 script, 5 font, 3 stylesheet
GET https://nullmask.io/ · script · 28 requests · network recording
E5
2 request(s) to www.googletagmanager.com
types: 2 script
GET https://www.googletagmanager.com/gtm.js · script · 2 requests · network recording
E6
2 request(s) to www.google-analytics.com
types: 2 fetch
GET https://www.google-analytics.com/g/collect · fetch · 2 requests · network recording
E7
Cookie '__vdpl' set for nullmask.io
session cookie
cookie __vdpl on nullmask.io · value not stored
E8
Cookie '_ga' set for nullmask.io
kept for about 400 days
cookie _ga on nullmask.io · value not stored
E9
Cookie '_ga_R7WC64N31N' set for nullmask.io
kept for about 400 days
cookie _ga_R7WC64N31N on nullmask.io · value not stored
E10
Svelte / SvelteKit found in the code
nullmask.io/ (page HTML) @ 73:533 · “svelte-rm02nq” · pattern scan
E11
Google tag (gtag.js) found in the code
nullmask.io/ (page HTML) @ 4:60 · “googletagmanager.com/gtag” · pattern scan
E12
Uses the browser ability: clipboard_write
can copy text to your clipboard
nullmask.io/_app/immutable/nodes/2.DGazU7u6.js @ 4:12027 · “clipboard.writeText(” · pattern scan
E13
Uses the browser ability: canvas
draws graphics on a canvas
nullmask.io/_app/immutable/nodes/2.DGazU7u6.js @ 1:128053 · “getContext("2d"” · pattern scan
E14
The page called /api/waves on nullmask.io (GET)
GET https://nullmask.io/api/waves · fetch · network recording
E15
Code reader found the endpoint /api/waves
how: call:fetch
nullmask.io/_app/immutable/nodes/2.DGazU7u6.js @ 4:5306 · “/api/waves” · the code reader
E16
1 links to pages on the same site
page links · https://nullmask.io/ · /
E17
The site says: “…count abstraction. Automated privacy workflows: Handle swaps, bridging, and routing to maximize privacy without use…”
page text · https://nullmask.io/ · …count abstraction. Automated privacy workflows: Handle swaps, bridging, and routing to maximize privacy without use…
E18
The site says: “…e privacy: Enable Turing-complete spending scripts and zero-knowledge account abstraction. Automated privacy workflows: Hand…”
page text · https://nullmask.io/ · …e privacy: Enable Turing-complete spending scripts and zero-knowledge account abstraction. Automated privacy workflows: Hand…
E19
The site says: “…es Next wave in Live Leaves at 07:15 Your time · GMT+0 Open app MASK HuAXPy…CUa7 Buy Nullmask has solved the everlasti…”
page text · https://nullmask.io/ · …es Next wave in Live Leaves at 07:15 Your time · GMT+0 Open app MASK HuAXPy…CUa7 Buy Nullmask has solved the everlasti…
E20
The Internet Archive first saved nullmask.io on 2025-11-06 and has snapshots from 14 different days
page web archive · https://web.archive.org/web/20251106010229/nullmask.io
E21
Agent step 1: view
AI agent step 1 · view on /
E22
Agent step 2: click Open app
AI agent step 2 · click on / · page called POST www.google-analytics.com/g/collect, POST www.google.com/g/collect, POST proxy.nullmask.io/, GET guard.nullmask.io/v1/public-config, POST app.nullmask.io/cdn-cgi/rum, GET app.nullmask.io/api/points/program, GET app.nullmask.io/shield, GET app.nullmask.io/send, GET app.nullmask.io/swap, GET app.n
E23
Agent step 3: click Swap (not done: Blocked: actions that pay, sign, trade or send are not allowed here.)
AI agent step 3 · click on /
E24
Agent step 4: click Analytics (not done: Locator.click: Timeout 4000ms exceeded.)
AI agent step 4 · click on /
E25
Agent step 5: click Skip intro
AI agent step 5 · click on /
E26
Agent step 6: click Analytics
AI agent step 6 · click on /analytics · page called GET app.nullmask.io/analytics, POST app.nullmask.io/cdn-cgi/rum, GET app.nullmask.io/api/analytics
E27
Agent step 7: go /swap
AI agent step 7 · go on /swap · page called POST proxy.nullmask.io/, GET guard.nullmask.io/v1/public-config, POST app.nullmask.io/cdn-cgi/rum, GET app.nullmask.io/api/points/program, POST ethereum-rpc.publicnode.com/, GET app.nullmask.io/, GET app.nullmask.io/shield, GET app.nullmask.io/send, GET app.nullmask.io/bridge, GET app.nullmask.io/an
E28
Agent step 8: click 500
AI agent step 8 · click on /swap · page called POST ethereum-rpc.publicnode.com/
E29
Agent step 9: go /
AI agent step 9 · go on /docs · page called POST www.google-analytics.com/g/collect
E30
Agent step 10: click Project Roadmap
AI agent step 10 · click on /docs/project-roadmap · page called GET nullmask.io/docs/project-roadmap/__data.json, POST www.google-analytics.com/g/collect
E31
Agent step 11: click What stays private
AI agent step 11 · click on /docs/privacy · page called GET nullmask.io/docs/privacy/__data.json, POST www.google-analytics.com/g/collect

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 4 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id vN4yFFId.