Browsercoin

Risks of In-Browser Node Mining (BrowserCoin)

BrowserCoin (BRC) is an experimental cryptocurrency architecture designed to run full or light blockchain nodes directly inside consumer web browser tabs. By leveraging WebAssembly (WASM) for multi-threaded Proof-of-Work hashing and WebRTC for peer discovery, BrowserCoin eliminates software installation barriers. However, executing a consensus engine inside an un-isolated browser sandbox creates significant structural, cryptographic, and hardware security vulnerabilities.

Interactive Risk Estimators

1. Hardware & Battery Impact

Select your device profile:

2. Network & Bandwidth Exposure

Select your network type:

3. Wallet Key Storage Security

Select your browser privacy settings:

Key Hazard Categories

1. Hardware Degradation & Thermal Fatigue

Continuous WASM Proof-of-Work (PoW) hashing forces consumer CPUs and GPUs to run at maximum thermal capacity without OS-level thermal monitoring, leading to accelerated lithium-battery degradation, fan wear, and sudden browser tab crashes.

• Mitigation Strategy: Implement strict WASM thread throttling at the protocol level. Integrate the Battery Status API to automatically pause hashing when the device is unplugged or drops below 30% charge.

2. Ephemeral Storage & Irrecoverable Key Loss

Browser storage (`localStorage` / `IndexedDB`) is inherently temporary. Clearing browsing data, automatic OS storage cleanup, or aggressive privacy extensions instantly wipe local wallet keys, rendering accumulated funds permanently inaccessible.

• Mitigation Strategy: Force a mandatory "Save Keystore / Seed Phrase" prompt before the user can begin mining or receiving funds. Do not allow mining to start until the backup is confirmed.

3. Transient Node Churn & 51% Attacks

Because nodes exist only while browser tabs remain open, total network hash rate collapses during off-peak hours. A coordinated actor utilizing a modest cloud instance or headless browser fleet can capture over 51% of the hash rate during low-activity windows to rewrite block history and double-spend BRC.

• Mitigation Strategy: Transition to a hybrid consensus model (e.g., PoW + Proof-of-Stake) where dedicated, long-running validator nodes outside the browser finalize blocks and prevent deep chain reorganizations.

4. Out-of-Browser ASIC/GPU Dominance

Off-chain actors can reverse-engineer the WebSocket/RPC protocol to execute optimized C++/CUDA PoW miners outside the browser engine. Native miners operate with a 10x–50x performance advantage, completely pricing tab-based users out of block rewards.

• Mitigation Strategy: Develop browser-specific, memory-hard hashing algorithms that rely on DOM elements or WebGL rendering quirks, making native compilation outside the browser difficult and inefficient.

5. Cryptojacking Abuse & AV Blacklisting

Malicious site operators embed unauthorized BRC mining scripts into third-party websites to monetize visitor CPU power. As a result, major antivirus suites, browser vendors, and ad-blocking extensions blacklist BRC domains and WebSocket bootstrap servers by default.

• Mitigation Strategy: Require a strict, un-bypassable visual UI overlay asking for explicit user consent ("Opt-In") before the WebAssembly mining engine is allowed to initialize.

6. Client-Side Security & In-Browser Key Theft

Browsers do not provide a hardware enclave isolation boundary for WebJS execution contexts. Any Cross-Site Scripting (XSS) vulnerability on the host site, or a compromised browser extension, can read private keys directly from memory or local storage.

• Mitigation Strategy: Isolate all key management and signing operations inside Cross-Origin Web Workers. Enforce strict Content Security Policy (CSP) headers to prevent unauthorized external scripts from executing.

7. Headless Botnet Sybil Attacks

Attackers can deploy massive fleets of automated, headless browsers (Puppeteer/Playwright) to flood the P2P discovery layer. These Sybil nodes can isolate legitimate browser tabs, reject valid transactions, feed false chain state, or hijack signaling servers.

• Mitigation Strategy: Implement WebAuthn, CAPTCHAs, or browser fingerprint attestation during the initial bootstrap phase to verify that a human is driving the browser before granting full P2P routing privileges.

8. Unbounded Bandwidth & Metered Data Charges

Operating as a full node inside a browser tab requires continuous P2P message passing over WebRTC datachannels. For users on metered connections or mobile hotspots, open tabs can consume tens of gigabytes of background data without user awareness.

• Mitigation Strategy: Utilize the Network Information API to detect cellular/metered connections and automatically switch the client to "Light Node" mode, disabling block propagation and WebRTC gossiping.

9. Browser Engine Exploitation (WASM/WebRTC Zero-Days)

Forcing the browser to process complex WASM compilation and manage raw WebRTC peer connections expands user exposure to web engine zero-day vulnerabilities, potentially allowing malicious network peers to execute sandbox escapes.

• Mitigation Strategy: Ensure the protocol strictly sanitizes all incoming WebRTC data packets. Encourage users to keep their browsers up-to-date, as patching relies entirely on downstream vendors (Chrome, Firefox, Safari).

10. Legal, GDPR & Web Hosting ToS Violations

Running background mining or P2P nodes frequently violates cloud hosting Terms of Service (e.g., AWS, Vercel) and ISP acceptable use policies. Furthermore, P2P peer discovery publicly exposes user IP addresses across WebRTC networks, creating conflicts under GDPR privacy frameworks.

• Mitigation Strategy: Provide a built-in "Privacy Mode" that connects the miner to a centralized stratum pool over secure WebSockets (WSS) instead of broadcasting the user's IP directly to random peers via WebRTC.

Summary Risk Matrix

Risk Vector	Threat Level	Primary Cause	Impact
Hardware Degradation	High	Unthrottled WASM PoW	Battery damage, fan wear
Ephemeral Key Loss	Critical	LocalStorage clearing	Irrecoverable wallet loss
51% Reorg Attack	Critical	Off-peak hash rate drops	Double-spending, rewritten chain
Native ASIC/GPU Mining	High	Protocol reverse-engineering	Casual tab miners displaced
Cryptojacking / Blacklisting	High	Unsanitized site embeds	Domain & IP blacklisting
Client XSS Key Theft	Critical	Lack of hardware enclave	Stolen wallet private keys
Headless Sybil Botnets	High	Open P2P discovery	Eclipse attacks, routing poison
Bandwidth Overages	Medium	Continuous WebRTC gossip	High mobile data charges
WASM/WebRTC Zero-Days	High	Complex P2P payload processing	Remote code execution
ToS & GDPR Conflicts	High	Public IP exposure & CPU abuse	Account bans, privacy fines

Show Data and Models

Risk Data

Browsercoin:browsercoin hardware

hardware_type	tdp_watts	annual_battery_loss_pct	reference
Mobile / Tablet	7	28	[1]
Thin & Light Laptop	28	18	[2]
Performance / Gaming Laptop	65	12	[3]
Desktop PC	105	0	[4]

Browsercoin:browsercoin network

connection_type	monthly_gb	overage_risk	notes
Metered Mobile (5G/LTE)	35	High Risk	WebRTC P2P gossip rapidly exhausts mobile data caps.
Home Broadband (Fiber)	35	Low Risk	Background P2P bandwidth negligible on unlimited plans.
Public Wi-Fi / Roaming	35	Critical Risk	Likely to trigger network abuse throttling or firewall blocks.

Browsercoin:browsercoin storage

storage_mode	loss_probability	retention_impact
Incognito / Private Window	100%	Keys deleted immediately when tab or window is closed.
Auto-Clear Browsing Data on Exit	90%	Keys wiped upon browser restart unless explicitly exported.
Standard Persistent Profile	35%	Keys vulnerable to OS storage eviction during low-disk states.

Risk Models

RiskModel: Browsercoin:battery_degradation_model
Content: Estimated annual battery capacity degradation for this device: '''{annual_battery_loss_pct}%'''

RiskModel: Browsercoin:power_cost_model
Content: Estimated annual power consumption at continuous load: '''{{#expr: ({tdp_watts} * 24 * 365 / 1000) round 1}} kWh/year'''

RiskModel: Browsercoin:bandwidth_usage_model
Content: Estimated monthly background peer traffic: '''{monthly_gb} GB/month''' (Risk Level: '''{overage_risk}''') - ''{notes}''

RiskModel: Browsercoin:key_loss_model
Content: Estimated probability of irrecoverable key loss: '''{loss_probability}''' - ''{retention_impact}''