BadCoin Wallet Chrome extension security report

BadCoin Wallet is a self-custodial wallet for the BadCoin (BAD) blockchain. It runs entirely in your browser. Your keys stay on your device. WHAT IT DOES Generate a new BadCoin wallet, or import an existing one from a WIF private key or BIP39 seed phrase. View your address as text or as a scannable QR code. Check your on-chain balance. Send BAD to any BadCoin address with an optional memo. Lock the wallet with a passphrase. Auto-lock after 30 minutes of inactivity. Reset to factory defaults with a typed confirmation gate. ADDRESS FORMAT BadCoin Wallet derives modern P2SH-wrapped-P2WPKH addresses (the B-prefix addresses that BadCoin Core has shipped since SegWit activation). Legacy P2PKH addresses (the older C-prefix format) are accepted on imports for backward compatibility with pre-SegWit wallets. KEY HANDLING Your private key is generated locally using your browser's built-in WebCrypto random source. It is encrypted at rest with AES-GCM-256 using a key derived from your passphrase via PBKDF2-HMAC-SHA256 at 600,000 iterations. The encrypted blob is stored in browser-local IndexedDB. The plaintext key only exists in service-worker memory while the wallet is unlocked, and is zeroed immediately on lock, on auto-lock, on factory reset, or when the service worker is suspended. Your passphrase never leaves your device. It is never written to disk. It is never sent to any server. WHAT YOU GET ON GENERATION After you generate a wallet you receive a one-time recovery view that shows your address, your public key, and your Wallet Import Format (WIF) private key. You can copy each value, or download a self-contained HTML recovery file with inline QR codes for each. The recovery view requires an explicit acknowledgement before continuing. Once acknowledged the recovery payload is wiped from memory. WHAT IT DOES NOT DO This extension does not mine cryptocurrency. This extension does not collect, transmit, or store any analytics or telemetry. This extension does not require an account or registration. This extension does not communicate with any centralized BadCoin server for key custody. There is no key custody. This extension does not promise rewards, yield, earnings, or any financial return. NETWORK BEHAVIOR When unlocked, the wallet contacts the BadCoin block explorer at https://explorer.badcoin.dev to fetch your balance and the Unspent Transaction Outputs needed to build a send. When you send BAD, the signed transaction is POSTed to the same explorer's broadcast endpoint. No other network calls are made by default. Optional overlays for phishing detection and exchange-deposit warnings are off by default. They activate only on BadCoin domains you explicitly grant permission to. BADGLYPH INSCRIPTIONS The wallet includes a signing surface for BadGlyph, an inscription format that writes a small payload into an ordinary BadCoin transaction. A content script runs on cipherglyph.org, the public BadGlyph viewer, so that site can ask your wallet to sign an inscription. Every request opens a separate confirmation window showing exactly what you are about to sign, and nothing is signed without your approval. The wallet also links out to cipherglyph.org so you can view the glyphs held by your address. This is the only website the extension injects a content script into. PERMISSIONS, IN PLAIN LANGUAGE Storage: To save your encrypted wallet records and settings in browser-local IndexedDB. Nothing is synced to Google. Alarms: To run the 30-minute auto-lock timer and the periodic reconciliation poller. No network alarms are scheduled while the wallet is locked. Notifications: To surface a desktop notification when the wallet auto-locks or when a phishing redirect fires. webNavigation: To intercept navigations to phishing URLs on the local blocklist and route them to an in-extension warning page. The blocklist ships bundled with the release and is not phoned home for updates. clipboardWrite: To copy your BadCoin address or a transaction id to your clipboard when you press a Copy button. The extension does not read your clipboard. OPEN SOURCE Source code is publicly available. Every cryptographic primitive, every network call, every key-handling path is reviewable. The project ships a public test suite of over 1,000 unit tests covering address derivation, signing, transaction building, encryption, key zeroing, and UI state machines. BROWSER SUPPORT Chrome 121 and newer. Other Chromium-based browsers that support Manifest V3 service workers (Edge, Brave, Arc, Opera) are expected to work but are not formally tested in this release. DISCLAIMERS BadCoin (BAD) is a community cryptocurrency. Cryptocurrency values are volatile. Blockchain transactions are irreversible. You alone are responsible for safeguarding your passphrase and your recovery file. If you lose your passphrase and your recovery file, you lose access to your funds. There is no recovery service. There is no support line that can restore a lost wallet. This extension is not a regulated financial product. It is a key-management and transaction-signing tool. It does not provide investment advice, brokerage services, or custody. SUPPORT For questions, bug reports, or contributions, see the project repository linked in the developer profile.