Club HashCash Wallet Chrome extension security report

Club HashCash Wallet — Non-Custodial HCASH Browser Wallet The official browser wallet for the HashCash proof-of-work blockchain. Manage your HCASH directly from Chrome — no accounts, no sign-ups, no middlemen. Your keys stay on your device, always. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHAT IS HASHCASH? ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ HashCash (HCASH) is a competitive proof-of-work blockchain operated as a game. Mining access is granted to the highest tHCASH stakers on Avalanche C-Chain — the more you stake, the better your position to earn a mining slot when NanoMiner hardware launches. Club HashCash is the community behind it. Members stake, mine, and compete for block rewards in a system designed to make proof-of-work accessible and fair. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ FEATURES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ✦ Create or import a wallet Generate a brand new HCASH wallet from a secure 12-word BIP39 mnemonic, or import an existing wallet using your recovery phrase. Full BIP32 HD wallet support — one seed, unlimited addresses. ✦ Multiple addresses Derive and manage multiple addresses from a single seed. Switch between them with a dropdown, or generate a new address with one click. Each address is independently tracked on the blockchain. ✦ View your balance See your confirmed HCASH balance and unconfirmed (mempool) balance in real time. All UTXOs (unspent transaction outputs) are listed so you know exactly what you're holding. ✦ Send HCASH Build and broadcast transactions directly from the wallet. Enter a recipient address, amount, and fee — the wallet signs the transaction locally and broadcasts it to the HashCash network. ✦ Encrypted local storage Your seed phrase is encrypted with AES-256-GCM using a key derived from your password (PBKDF2, 250,000 iterations). Nothing is ever sent to a server. Lock your wallet when you're done. ✦ Native SegWit (Bech32) Addresses use the native SegWit P2WPKH format with the "hcash" Bech32 HRP — the same format used by the HashCash Core node. Transactions save 36% on fees compared to legacy formats. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ SECURITY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Your private keys never leave your device. The wallet uses: • BIP39 — industry-standard mnemonic generation • BIP32 HD derivation — deterministic key generation at m/84'/0'/0'/0/n • AES-256-GCM encryption — your seed is encrypted before storage • PBKDF2 with 250,000 iterations — brute-force resistant key derivation • Noble/Scure cryptography libraries — audited, pure-JavaScript crypto with no native binaries or WASM The only network request this extension makes is to hashmind.tools/api/hchain — a server-side proxy that relays your public wallet address to the HashCash block explorer to retrieve balance and UTXOs. Your password and private keys are never transmitted. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ HOW TO GET STARTED ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. Install the extension and click the Club HashCash icon in your toolbar 2. Choose "Create New" to generate a fresh wallet, or "Import Seed" to restore an existing one 3. Set a strong password — this encrypts your seed phrase on your device 4. Write down your 12-word recovery phrase and store it somewhere safe offline 5. Copy your wallet address and use the HashCash faucet (faucet.hashcash-test.network) to receive your first HCASH 6. Hit Refresh to see your balance appear ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PERMISSIONS EXPLAINED ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ This extension requests only two permissions: • storage — to save your encrypted seed and address index locally in Chrome • host access to hashmind.tools — to query the HashCash block explorer and broadcast transactions No other permissions are requested. No access to your browsing history, tabs, clipboard, or any other extension data. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ BUILT ON OPEN STANDARDS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ The Club HashCash Wallet is built using the same open Bitcoin standards that power the broader crypto ecosystem: • BIP39 — Mnemonic code for generating deterministic keys • BIP32 — Hierarchical deterministic wallets • BIP84 — Derivation scheme for native SegWit • BIP143 — Transaction signature hashing for SegWit inputs • Bech32 encoding with the "hcash" human-readable prefix ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ LINKS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ • Website: hashmind.tools • Privacy Policy: hashmind.tools/privacy • Community: hashcash.club • Twitter: @hashmindtools / @ClubHashCash • Block Explorer: explorer.hashcash-test.network • Faucet: faucet.hashcash-test.network ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ This is testnet software. HCASH on the HashCash testnet has no monetary value. Always back up your recovery phrase — lost phrases cannot be recovered.