Brave Browser Rewards Logic Flaw (PoC)

A Proof of Concept (PoC) demonstrating a logic flaw in Brave Browser's Reward system. Uses Python automation to bypass ad-view limits via excessive profile creation, ad farming and mass tipping.

---

⚠️ Disclaimer

For Educational and Research Purposes Only. This project was developed to analyze logical inconsistencies in Brave's ad reward systems. The vulnerability has now been patched, and this code is shared only to demonstrate the power of exploiting such simple bugs.

---

The Vulnerability

Brave Browser at the time of research had a ad reward system which gives users BAT tokens for every ad they watch serverd by the browser through OS notifications as well as homepage ads there was a cap limiting the number of ad notifications a user could receive per hour(4/hr) to prevent abuse. However, the system tracked these limits locally per User Profile.

The Logic Flaw:

1. The "Ad Limit" was not tied to the hardware ID or per browser effectively.
2. By creating isolated User Profiles, the local counter resets.
3. This allowed for the automation of profile creation $\rightarrow$ Ad Interaction $\rightarrow$ BAT Accumulation $\rightarrow$ Mass Tipping.

The Exploitation Logic

Initially, I lacked formal Python expertise, but the discovery of this logic flaw drove me to learn automation to scale the vulnerability.

I could theoretically multiply the rewards by the number of profiles created.

Automation Workflow

1. Profile Generation: I automated the creation of 200 distinct browser profile directories, effectively treating each as a unique user to the ad system.

2. Ad Interaction Loop :

   • The script launches a profile.
   • It executes a sequence of 16 refreshes to guarantee ad impressions.
   • Once the hourly cap for that profile is hit, the script kills the process and moves to the next profile.

3. Fund Aggregation: The challenge was collecting the fragmented BAT tokens from 100+ isolated profiles.

   • I created and verified a YouTube channel via the Brave Creators program.
   • The script instructed each profile to tip its accumulated earnings to this specific channel, effectively funnelling all decentralized rewards into a single, withdrawable wallet.

Impact & Yield Analysis

At the time of discovery, the reward rate was fixed at 0.01 BAT per ad impression. By scaling the profile rotation, I achieved the following result:

• Reward per Ad: 0.01 BAT
• Ads per Profile: ~4 (per cycle)
• Throughput: ~200 profiles cycled per hour

The Calculation: $$0.01 \text{ BAT} \times 4 \text{ ads} \times 200 \text{ profiles} \approx \mathbf{8 \text{ BAT/hour}}$$

Final Outcome: I successfully aggregated approximately 112 BAT (valued at ~₹13,216 at peak rates) using this method. Shortly after this period, Brave rolled out a patch linking ad limits to hardware/OS fingerprints rather than local profile directories, effectively mitigating this specific profile-isolation attack vector.

🛠️ Tech Stack

• GUI Automation Software
• Python

---

Note on Source Code:

The code does not work exactly now as brave has made major UI changes and the button coords need to be changed for replicating the behaviour. This repository serve as a technical documentation of the logic and methodology used during the research period.

Evolution of the Bot:

• Version 1 (Prototype): Initially I built it on a GUI-based macro recorder. However, this approach lacked error handling and failed when ads didn't load in time.
• Version 2 (Python): Migrated the logic to Python (using PyAutoGUI) to implement robust exception handling, dynamic wait-times, and headless execution for better performance.

---

Usage

(Note: This logic is no longer function due to updates in the Brave Rewards Protocol)