What the page is
A consented cryptominer: RandomX compiled to WebAssembly, in a Web Worker,
sending shares to MoneroOcean with your wallet as the pool login. Nothing starts until you press
Start. VoltMiner takes 0%; the relay rewrites nothing, so a redirected payout would appear as
somebody else's address on the pool dashboard.
Audit it in five minutes
- Read what runs. The page and the scripts in
js/ are not minified — view-source, or
curl https://web.voltminer.net/js/miner-worker.js.
- Check no third-party code can load.
curl -sI https://web.voltminer.net/ | grep -i content-security-policy →
default-src 'none'; script-src 'self'; connect-src 'self' …. No analytics, no CDN,
no remote import, no inline script.
- Check the bytes you were served.
curl -s https://web.voltminer.net/js/vendor/randomx/web-randomx-mt.wasm | shasum -a 256
and compare with SHA256SUMS.
- Check the wasm is a build of public code. wasm-patch/ is the
shared-memory web-randomx-mt build: every file we changed on top of
RandomX-bonanza
f9848e3 — a WebAssembly JIT backend on the RandomX engine — plus
build-web-randomx-mt.sh (Docker + Emscripten 4.0.10)
that reproduces it. The single-thread web-randomx binary is the earlier WebRandomX build —
its overlay is wasm-patch-webrandomx/.
- Read the relay. relay/server.mjs is the entire server: one WebSocket
from an allowlisted Origin, one TLS connection to the pool's host/port (hardcoded, certificate pinned by SHA-256),
each line checked for JSON validity, then forwarded. It never rewrites a login, a job or a share.
- Check the payout. The page prints the exact login it sent (<your wallet>+10000)
and links the pool's own dashboard and API for that address. That is the ground truth, not our word.
What is not published
The rest of the product (UI code, design, the Anvil app): readable in your browser, not licensed for
reuse. The ~2 GB dataset is RandomX's cache for the current network seed stored in this origin's private storage —
delete it with the button on the page or by clearing site data.
What the relay logs
Connection events only: peer IP, the Origin header, session count, accept/close reasons. Stratum
payloads — including your wallet inside the login line — are never parsed for content and never logged. Your
address is not stored anywhere on our side.
Who to tell
Security reports:
GitHub advisories
(also /.well-known/security.txt). Everything else:
contact.
Third-party licences for the bundled Wasm (the RandomX engine and Berkeley SoftFloat are
BSD-3-Clause; the wasm JIT backend is CC0; jit_stubs/semifloat.c and
mulh.c are BSD-3-Clause © tevador and l-m; the Emscripten runtime is MIT) are in
NOTICE.txt and notices.html.