Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: Linea is the chain with the fullest card config in the MetaMask Mobile defaults (metamask-mobile b513a4b, app/selectors/featureFlagController/card/defaults.ts#L37-L102: FoxConnect spender addresses, a balance scanner and eight spendable tokens), and Crypto Life's product page says cardholders spend USDC, USDT and WETH from their wallet on Linea. Unit: the Global FoxConnect spender 0x9dd23A4a... at Linea block 32253699. Excluded: the US FoxConnect 0xA90b298d... (noted in C1 and S2), the Base, Monad and Solana configs, and the Immersve-run UK card on Base.
Offered only in the countries listed. Checked 2026-10-09. Not scored.
MetaMask's support article lists 48 countries eligible for sign-up. The list does not include the whole EU (for example Czechia, Estonia, Latvia and Lithuania are absent), so countries are listed one by one. The United States is excluded: the same page says the card is not currently available for sign-ups there, and existing US cardholders under the separate Baanx US / Cross River programme can keep using their cards. Product variants: the UK programme is migrating to Immersve on Base, and the US programme was not assessed. The Crypto Life platform terms require residence "in a country where Baanx products & services are available" and let CL restrict countries at its discretion, but they name none. The FAQ says ineligible regions limit sign-ups, not spending; the card can be used wherever Mastercard is accepted. Only virtual cards are open to new sign-ups.
CL Platform Terms (Monavate 2025), section 3 Eligibility, require residence in a country where Baanx products and services are available, without naming countries.
MetaMask support article "What is MetaMask Card?" lists 48 countries under "What countries are eligible to sign up for MetaMask Card?" and says US sign-ups are not currently available.
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
Other token. A wrapped, liquid-staking or yield token. It carries the risks of the underlying asset plus those of the wrapper or protocol; see the note.
Platform token. Issued by the provider or its own ecosystem. Its value and liquidity depend on that provider, which may also control supply.
Tokens stay in the user's wallet under a spending delegation and are sold for fiat when a payment is made. There is no fixed default: the card spends the token the user ranks first in 'Manage', and the FAQ's example uses USDC. The list is the Linea card config in MetaMask Mobile; Base, Monad and Solana have their own token lists in the same file and the UK programme is moving to Immersve on Base. Classes: WETH is wrapped ETH; aUSDC and amUSD are Aave interest-bearing deposit tokens for USDC and mUSD; mUSD (MetaMask USD) is MetaMask's own-branded dollar stablecoin, so it is classed as platform. mUSD is also the cashback and withdrawal currency.
Checked 2026-10-12
Evidence (3)1 verified · 2 claimed
Verified
The Linea card config enumerates eight spendable tokens by address (USDC, USDT, WETH, EURe, GBPe, aUSDC, mUSD, amUSD) next to the FoxConnect spender addresses.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 1 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
FoxConnect has no pause or blacklist, but every card settlement is a withdraw() that only an allowlisted operator can call, and the operators are EOAs run by Baanx. Any one of them can stop or selectively skip settlement, which meets anchor 0 on its own. The operator list is set by a 2-of-4 Safe with undisclosed signers, no modules, no guard and no timelock. On the excluded US deployment the owner is a single EOA. On the card side, Monavate's terms allow it to close or suspend a card immediately. Both the EOA-held settlement role (verified) and the documented card suspension meet anchor 0.
Evidence (4)3 verified · 1 documented
Verified
FoxConnect (Global) getWithdrawOperators() returns 33 addresses (all sampled ones are EOAs, e.g. 0x4C893CF4... nonce 166378); withdraw() pulls from any approving wallet to the beneficiary and only an operator can call it; owner() is Safe 0x1b7A8fF5...9c99, which can add or remove operators.
Owner Safe (v1.4.1) getThreshold() = 2 with 4 owners (0xce5ff475..., 0x3707C120..., 0x71144589..., 0xE9701D60...); getModulesPaginated(0x1,10) returns no modules and the guard slot is zero. No timelock sits in front of it.
The US FoxConnect's owner() is 0x0AB5e068fA215bA0A317c93DCaF73fcdDF9c814A, an address with no code (EOA, nonce 41), and its single withdraw operator is EOA 0x4C893CF4....
Monavate's cardholder terms (linked from Crypto Life's legal page) let the issuer close the card or suspend access immediately, including where it believes continued use could damage its reputation.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The merchant is paid by Mastercard and Monavate offchain. The only onchain step is a pull from the cardholder's wallet that only Baanx's operator keys can execute. Neither payer nor payee can complete a card payment by calling the contract directly.
Evidence (2)2 verified
Verified
Verified FoxConnect.sol has two entry points that move tokens. withdraw() requires withdrawOperatorMap[msg.sender]. multiSend() requires multiSendOperatorMap[msg.sender] and an EIP-712 signature from signerAddress (EOA 0x11084c82...56CB).
Sample card pull. Operator EOA 0x2AcFE192... called withdraw() (selector 0xf7ece0cf), moving 68,698 base units of mUSD from cardholder 0x0edC0eA6... to beneficiary Safe 0x8dFE562C....
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every card payment needs Baanx's closed authorisation backend and its operator keys, plus Monavate and Mastercard. None of these is public and none has a fallback, so the card path is closed and single-vendor.
Evidence (2)1 verified · 1 claimed
Verified
The card provider's base URL and API key come from build-time env (BAANX_API_URL, MM_CARD_BAANX_API_CLIENT_KEY); builds.yml#L44 sets production to https://api.baanx.com. No Baanx backend code is public.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: VerifiedChecked 2026-10-12 7 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
FoxConnect itself has no address or country filter. Sanctions and country screening exist and are disclosed in the terms, but they run in the closed Baanx backend and cannot be bypassed, because there is no direct settlement path (C2 = 0). Disclosed in docs only, so 1.
Evidence (2)1 verified · 1 documented
Verified
Sign-up preselects the country from device geolocation, and eligibility comes from registrationSettings fetched from the Baanx API. The client contains no sanctions list; screening runs server-side.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Tokens and chains are enumerated in code. The tokens carry issuer controls: USDC has a blacklister and a pauser, and mUSD can freeze accounts and force transfers. Linea also runs a centralised sequencer. None of these assumptions appears in the MetaMask support pages or the Crypto Life terms I read. Enumerated in code, assumptions not stated, so 2.
Evidence (3)3 verified
Verified
The Linea card config enumerates eight tokens by address (USDC, USDT, WETH, EURe, GBPe, aUSDC, mUSD, amUSD). Base, Monad and Solana are enumerated in the same file.
The mUSD proxy points to implementation 0x58a3a9c5... (Sourcify exact match, BUSL-1.1), which exposes freeze, freezeAccounts, forceTransfer and pause under FREEZE_MANAGER_ROLE, FORCED_TRANSFER_MANAGER_ROLE and PAUSER_ROLE.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
2 Partial
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The settlement contract is verified: an exact match on the explorer and a partial match on Sourcify. Its source exists only in verification metadata. No public repository or build script reproduces it, so 2.
Evidence (2)2 verified
Verified
Sourcify v2 returns match (partial, not exact_match) for FoxConnect Global and US; Lineascan shows "Source Code Verified (Exact Match)" for FoxConnect Global, compiler 0.8.23, license None.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Public: the app-side card client (source-available) and the verified FoxConnect source on Sourcify and Lineascan. Closed: the Baanx API (no published schema), the authorisation backend and the operator service. Judgment call: this is more than "SDK or contracts only", but without the backend or an API schema it does not reach 2, so 1.
Evidence (1)1 verified
Verified
The card client (onboarding, spending limit, delegation, card details) is public in metamask-mobile. No Baanx organisation or repo exists on GitHub, and no FoxConnect, backend, operator or API-schema repo was found.
Can a stranger reach a working deployment from the README? O3
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Build docs exist for the client. Reproduction not attempted. The README alone shows blockers: card features need a Baanx-issued client key and Baanx's hosted API, and there is no self-host path for the card backend.
Evidence (1)1 verified
Verified
The README covers building the app (Infura key, .js.env, Expo, yarn setup). The card needs MM_CARD_BAANX_API_CLIENT_KEY and the hosted Baanx API, which the README does not provide.
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Interfaces are available only through verification metadata, not versioned in a provider repo. There is no API schema, and I found no payee or cardholder export in the repo. Judgment call: between "documented only" and "none"; ABIs are recoverable, so 1.
Evidence (2)2 verified
Verified
FoxConnect's ABI and events (WithdrawalStatus, MultiSendStatus, operator and treasury events) are available from Sourcify metadata. No repo versions them.
Does every repository needed to run the product carry an OSI-approved license? F1
! Under review
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-12 7 days agoDrift
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The weekly re-check found that a recorded fact changed. This rating counts as unknown until a reviewer re-checks it.
Nothing in the payment path is under an OSI license. The client is inspect-only, the settlement contract is UNLICENSED, and the backend, operator keys, issuer and network are closed. Closed required components alone set F1 to 0.
Evidence (2)2 verified
VerifiedDrift
The metamask-mobile LICENSE grants only a "limited non-exclusive license to inspect and study the code", with no right to modify or redistribute.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Analytics (MetaMetrics) and error reporting (Sentry) ship in the app and are consent-gated, but a forced Sentry path reports critical errors before consent. The Baanx-hosted KYC and web dashboard were not inspected, and no trace was run. Judgment call: mostly opt-in (2), but the forced pre-consent path and the unseen hosted flows put this between anchors, so I took the lower one, 1.
Evidence (2)2 verified
Verified
Sentry initialises with enabled = forceEnabled || hasConsent. captureExceptionForced() turns it on without consent for critical errors.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Full KYC is required and is disclosed with a legal basis in the terms, but only in policy documents, not in a code or repo document. Collection goes well beyond settlement needs. Disclosed in policy, so 1.
Evidence (2)2 documented
Documented
Crypto Life's platform terms list identity data requested at registration (name, email, contact details, phone, username, government ID, date of birth), state that it is a regulatory requirement, and set a five-year retention period.
What do calldata and events reveal about who paid whom for what? P3
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No merchant or order data goes onchain. Every card spend is still a public transfer from the cardholder's everyday wallet to a known Baanx address, and the FoxConnect approval flags the wallet as a MetaMask Card holder. Anyone can read spend amounts and timing. There are no fresh addresses. Minimal linkage that the provider discloses, so 2.
Evidence (2)1 verified · 1 claimed
Verified
A card pull emits only an ERC-20 Transfer (cardholder 0x0edC0eA6... to beneficiary 0x8dFE562C..., amount) and WithdrawalStatus(result, batchSize). It carries no merchant or order data.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A card payment is seen by Baanx/Crypto Life, Monavate and Mastercard; the app also reads through Infura. These parties are named in docs and code but cannot be swapped. The KYC vendor behind Crypto Life is not named. No trace was run. Present and disclosed, not swappable, so 1.
Evidence (2)1 verified · 1 claimed
Verified
Card reads go to Infura URLs built from MM_INFURA_PROJECT_ID (Linea falls back to rpc.linea.build). These are hardcoded constants, not user settings.
Can RPC and indexer URLs be changed, and is the indexer code public? P5
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card module's RPC endpoints are hardcoded constants. Card data comes from Baanx's closed API, which is fixed at build time and has no public indexer. A user cannot point the card at their own endpoints.
Evidence (2)2 verified
Verified
Card RPC URLs are constants. Linea uses Infura or rpc.linea.build, and Base and Monad use Infura only.
Who holds funds between payer and payee, and can the provider redirect them? S1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
At rest, tokens stay in the cardholder's own wallet. Any of 33 Baanx operator EOAs can pull up to the full approved allowance from any approving wallet at any time, without a cardholder signature. The owner Safe can change where pulled funds go. Pulled funds then sit in a Baanx-held Safe and settle offchain. The provider can redirect funds within the allowance, which meets anchor 0.
Evidence (2)2 verified
Verified
Verified withdraw(tokens, sources, amounts) calls transferFrom(source, beneficiary, amount) for arbitrary sources, with no cardholder signature and no per-payment authorisation; setBeneficiary() is onlyOwner.
Who can change the contract code, and with how much notice? S2
3 Strong
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
FoxConnect is not upgradeable, and the same holds for the US deployment. Its owner can still change operators, signer, treasury and beneficiary, which is scored under C1 and S1, not here. The tokens are upgradeable by their issuers (USDC and mUSD are proxies), which is covered under C5.
Evidence (1)1 verified
Verified
The EIP-1967 implementation and admin slots are zero. The verified FoxConnect source (Ownable2Step, EIP712) has no delegatecall, proxy or selfdestruct path, so the code is immutable.
How large an allowance does the SDK ask users to grant, and for how long? S3
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The default approval is effectively unbounded (2.2 trillion tokens), with no expiry, to a spender that operator EOAs can pull from. A restricted amount is available as an opt-in. The default is labelled "Full access" in the UI, and the support page tells users they set a spending cap. Judgment call: labelled in the UI, so "unbounded by default, disclosed" (1) rather than 0.
Evidence (3)3 verified
Verified
Limit type defaults to 'full'; at L516-L520 'full' maps to BAANX_MAX_LIMIT = '2199023255551' tokens (constants.ts#L43). 'restricted' (a custom amount) is opt-in. The UI labels the full option "Full access".
Sample cardholder 0x0edC0eA6...De3E's mUSD allowance to FoxConnect is 2199023255543896596 base units, about 2.2 trillion mUSD, i.e. the full-access default less spends.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
2 Partial
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Chain of reasoning. By S1, funds at rest stay in the cardholder's own EOA and Baanx holds no key over it, so the holder can move funds or revoke the allowance through the token contract without Baanx. By C2 = 0 and C3 = 0, card settlement stops if Baanx disappears. By O3 = 1, no self-host path is proven. Funds already pulled to the beneficiary Safe stay with Baanx. A standing unbounded allowance also stays live until the user revokes it, so a compromised operator key could drain it (see S1 and S3). Funds retained and retrievable, settlement stops, so 2.
Evidence (1)1 verified
Verified
The sample cardholder is an EOA (no code) holding 29.451877 mUSD in its own balance. The tokens never leave the wallet until an operator pull, so the holder can transfer them, or approve(FoxConnect, 0), with their own key.
Are secrets kept out of client bundles and are webhooks signed and verified? S5
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A key labelled as a secret ships in every app bundle. What it authorises on Baanx's side is not visible. The code shows a mitigation: PKCE plus per-user credentials, so the key works as a public client identifier. There are no webhooks in the client. Judgment call: "secrets in client with a mitigation" (1). Whether the mitigation is disclosed beyond the code is unknown.
Evidence (1)1 verified
Verified
The build-time MM_CARD_BAANX_API_CLIENT_KEY is sent as both client_id and client_secret, and elsewhere as an x-secret-key header, from the mobile app. The OAuth flow uses PKCE (S256) and user email, password and OTP.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 1
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: Safe smart account v1.4.0 core contracts (singleton, proxy, factory, handlers), used by the Baanx FoxConnect owner, beneficiary and treasury Safes at eb93dbb0f6 The Linea Safes use the canonical SafeL2 v1.4.1 singleton 0x29fcB43b... (slot 0 read 2026-10-13). Safe says 1.4.1 added one ERC-4337 opcode bugfix after this audit and was not re-audited. Does not cover FoxConnect itself.
Partly
2 medium, 1 low, 6 warnings, 2 info; one warning fixed, the rest acknowledged
Compiled from: The MetaMask Card support pages and metamask-mobile repo (no card or FoxConnect audit), web searches for FoxConnect and Baanx / Crypto Life audits, the Consensys Diligence audit list (MetaMask Delegation Framework audits only; the card uses a plain ERC-20 approve, not that framework), and the docs/ audit folder of github.com/safe-fndn/safe-smart-account for the Baanx owner, beneficiary and treasury Safes. No audit of the FoxConnect spender contracts is published. A 2021 Blockchain Foundry report on a Baanx ERC-20 token exists but is not in the card path. Spendable-token audits (USDC, mUSD) are not logged here. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 15 evidenced, 0 attested, 3 absent, 0 not applicable, 27 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
payer
Annual subscription 0 USD (Free tier) or 199 USD (Metal tier); Metal card replacement 99 USD
MetaMask support limits-and-fees page.
fx
payer
0.5% when the stablecoin is in neither the cardholder's nor the merchant's currency; otherwise no fee
Same page, token fees; exception for Argentina where the card is USD-denominated.
provider
payer
0.875% when spending other cryptocurrencies (e.g. wETH); DeFi tokens free to 1,200 USD per month, then 0.5%
Same page, token fees.
card
payer
Cross-border 1% (Free tier), none for Metal (fair usage)
Same page; applies when the merchant is outside the cardholder's country.
cashout
payer
ATM 2% (Free tier); Metal free up to 1,200 USD per month, then 2%; ATM operator fees extra
Same page; ATM withdrawals are available to US cardholders only (FAQ).
network
payer
Network gas, typically about 0.01 USD on Linea
Same page.
The support site serves region-dependent guidance; the static HTML read here is the default (US) view. Metal cards are no longer offered to new UK users (UK migration guide). Judgment call: MetaMask's own support pricing page is treated as documented for fees, while the CROPS seed cited the support site as claimed.
Documented
MetaMask Card limits and fees table (Free and Metal tiers) with footnotes.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Hybrid: self-custody with a provider-controlled spend path
Tokens rest in the cardholder's own wallet; any of 33 Baanx operator EOAs can pull up to the approved allowance (unbounded by default) through FoxConnect to a beneficiary Safe the owner can change. Agrees with the S1 finding (score 0, provider can redirect funds within the allowance).
Only the EU issuer is evidenced from a register. Monavate Ltd (UK, company 12472532) is described in the CL terms as an FCA-authorised electronic money institution, but the FCA register is client-rendered and its API returned 403, so it is not listed here (attested only). New UK cards since 28 Sep 2026 are with Immersve, and US cards run under Baanx US with Cross River Bank; neither was checked. Crypto Life's terms say its crypto services are not regulated.
Documented
Bank of Lithuania register entry for UAB Monavate, authorisation code LB002139, company code 305628001, licence valid from 2022-03-31.
2% (Free tier); Metal free up to 1,200 USD per month
1,000 USD per transaction and per day (Free); only existing US cardholders, since US sign-ups are paused; other regions cannot use ATMs.
No bank withdrawal through the card programme is documented; refund credits withdraw to the user's wallet as mUSD, not fiat. US is not in the availability allowlist (sign-ups paused), so the ATM row only reaches existing US cardholders.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2024-03-06 (block 2715910): FoxConnect (Global) card spender 0x9dd23A4a0845f10d65D293776B792af1131c7B30 on Linea
Verified
FoxConnect Global has code size 0 at Linea block 2715909 and 9578 bytes at 2715910 (timestamp 1709721562, 2024-03-06 10:39:22 UTC); the receipt of tx 0x10f468bf...136a in that block has this contractAddress.
The cardholder contracts with Crypto Life (Baanx) and the issuer Monavate; MetaMask (Consensys) is the wallet provider and is not a party to the CL terms.
Documented
Companies House, company 11155611, active, incorporated 17 Jan 2018; name BAANX.COM LTD until 19 Aug 2026.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident disclosure found on the MetaMask card support pages, withcl.com or in the CL and Monavate terms; the Baanx privacy policy host fails TLS. No incident log exists to search.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
2026-09-28: UK programme moves to Immersve with USDC on Base; UK cards issued before this date, including Metal cards, stop working on 29 Dec 2026. source
US sign-ups are paused (support pages) with no date given, so it is not listed.
Documented
Companies House previous company names, BAANX.COM LTD 17 Jan 2018 to 19 Aug 2026.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not observable
FoxConnect.withdraw moves tokens with transferFrom from each cardholder wallet to the beneficiary Safe; FoxConnect's own WithdrawalStatus event carries no token or amount. The amounts appear only as ERC-20 Transfer logs on the token contracts (mUSD, USDC and others), which the spec cannot filter by recipient, and transfers to the beneficiary cannot be separated from other inflows without Baanx's records.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement found for Crypto Life / Baanx (now Monavate Onchain Ltd), Monavate or Consensys on the MetaMask card support pages, withcl.com home and legal pages, or the CL Platform Terms and Monavate cardholder terms. The Baanx global privacy policy (secure.baanx.co.uk) fails TLS from this environment.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
No hosting or support organisation certification found.
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
No SOC 2 or ISAE report or statement of availability found.
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
No audit of FoxConnect or the Baanx platform was found (CROPS S6 is unknown). withcl.com links to kudelskisecurity.com without a report.
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
No penetration-test report or attestation found.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown implied from the component list
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Absent
none of 1 repo(s): MetaMask/metamask-mobile ✗ no security policy file source 1
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown implied from the component list
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Evidenced
all of 1 repo(s): MetaMask/metamask-mobile ✓ dependabot config present source 1
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
Neither the CL Platform Terms nor the Monavate cardholder terms contain a security or data-breach notification commitment; the Baanx privacy policy could not be read.
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown implied from the component list
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown implied from the component list
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown implied from the component list
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
The card account (Crypto Life / Baanx) uses email and password plus a one-time code; the wallet itself is the user's MetaMask key. The OTP step is shown in the app code (S5 evidence); whether a second factor is required on every login is not stated. source 1 CROPS S5
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Evidenced
The app talks to the Baanx API with OAuth using PKCE (S256), user email, password and OTP. CROPS S5
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Evidenced
A single build-time client key is shipped in every app bundle and sent as client_id, client_secret and x-secret-key; with PKCE it acts as a public client identifier. Server-to-server keys between MetaMask and Baanx are not visible. Cross-reference CROPS S5 (score 1). CROPS S5
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Unknown implied from the component list
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Baanx retains account and transaction information for five years after account closure; Monavate lets the cardholder redeem e-money for up to six years after the agreement ends. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Crypto Life (Baanx) runs KYC and processes the personal data under its own privacy policy; MetaMask states it has no access to those details. No DPIA mentioned. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown implied from the component list
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Absent
none of 1 repo(s): MetaMask/metamask-mobile ✗ no deployment configuration source 1
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Evidenced
all of 1 repo(s): MetaMask/metamask-mobile ✓ rules: pull_request, non_fast_forward, required_status_checks, merge_queue, pull_request source 1
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Evidenced
all of 1 repo(s): MetaMask/metamask-mobile ✓ 95 workflow file(s) source 1
B9.3 Tests run in CI Do the CI workflows run the test suite?
Absent
none of 1 repo(s): MetaMask/metamask-mobile ✗ test command in a workflow source 1
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Evidenced
all of 1 repo(s): MetaMask/metamask-mobile ✓ coverage tooling referenced source 1
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Evidenced
all of 1 repo(s): MetaMask/metamask-mobile ✓ latest tags: v8.15.0, v8.14.0, v8.13.1 source 1
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Evidenced
all of 1 repo(s): MetaMask/metamask-mobile ✓ 10 of 10 recent commits signed source 1
B9.7 Changelog Is a changelog maintained with the code?
Evidenced
all of 1 repo(s): MetaMask/metamask-mobile ✓ CHANGELOG file source 1
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Evidenced
all of 1 repo(s): MetaMask/metamask-mobile ✓ CONTRIBUTING file source 1
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Unknown implied from the component list
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Baanx.com Ltd (England, company 11155611, renamed MONAVATE ONCHAIN LTD on 19 Aug 2026) under the CL Platform Terms; the card account is held with UAB Monavate (Lithuania, code 305628001) for EU customers and Monavate Ltd (England, 12472532) for UK customers. Consensys provides the MetaMask app. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Unknown implied from the component list
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Baanx: the user may cancel on 30 days' notice after requesting Restoration of assets; Baanx may end services on 60 days' notice with full Restoration, or suspend immediately on listed grounds. Monavate: the user may close on one month's notice and can redeem remaining e-money for up to six years. Tokens in the user's own wallet are unaffected (CROPS S4). source 1 · source 2 CROPS S4
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Unknown implied from the component list
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Scored the Global FoxConnect spender on Linea at block 32253699, from the MetaMask Mobile card defaults at metamask-mobile b513a4b. MetaMask Card is run by Crypto Life (Baanx), issued by Monavate, on Mastercard. Funding works by an ERC-20 approval from the cardholder's own wallet; Baanx operator EOAs pull through FoxConnect.withdraw. No Baanx or FoxConnect repository exists; contract source comes from Sourcify and Lineascan only. The Baanx global privacy policy (secure.baanx.co.uk) timed out from this network and is not cited. No audit of FoxConnect was found, so S6 is unknown.
