Designing Proof of Work & Economic Friction
How to use computational costs and micro-transactions to destroy the ROI of automated botnets.
As detailed in our Attacker ROI Calculator, automated web attacks are entirely profit-driven. An attacker pays for infrastructure (proxies, compute, solving APIs) to extract value (stolen credentials, limited inventory, data).
If you can increase the cost of the attack to exceed the value extracted, the attack mathematically ceases. This is the principle of economic friction.
Proof of Work (Hashcash)
The earliest concept of computational economic friction was Hashcash, proposed in 1997 to limit email spam. The concept is simple: before a server accepts a request, the client must solve a cryptographic puzzle that requires CPU time to compute but is trivial for the server to verify.
How it works in modern web apps
- The server issues a challenge string.
- The client's JavaScript must find a nonce (a random number) that, when hashed with the challenge string (e.g., using SHA-256), produces a hash with a specific number of leading zeros.
- The client submits the nonce. The server performs a single hash operation to verify.
For a human user, the browser might spend 2 seconds computing this hash before submitting a form. The delay is barely noticeable.
However, an attacker running a botnet attempting to submit 10,000 forms per second suddenly needs massive, expensive compute clusters to generate those hashes. The cost of infrastructure spikes, destroying their ROI. Systems like Cloudflare Turnstile utilize managed Proof of Work under the hood.
Micro-Transactions and Staked Value
A more aggressive approach involves actual monetary friction.
If a platform requires a user to stake a tiny amount of fiat or cryptocurrency to perform an action, the economics of botting collapse.
The $1.00 Verification Fee
Consider a high-value ticket platform plagued by scalper bots. If the platform implements a $1.00 non-refundable verification hold on a credit card to enter a queue, a human user wanting a ticket will gladly pay it (or have it applied to the ticket price).
An attacker operating 50,000 bots to flood the queue must now front $50,000. Furthermore, processing 50,000 credit card authorizations triggers massive fraud alerts at the payment processor level, exposing the attacker's network.
Web3 and Gas Fees
While often maligned, blockchain transaction fees (gas) act as an inherent, un-bypassable economic friction layer. A Sybil attack (creating millions of fake identities) on a network that requires $0.05 per transaction is prohibitively expensive. This is why decentralized identity protocols often require a staked token to participate.
The Accessibility Trade-off
The primary danger of economic friction is the accessibility tax.
Heavy JavaScript Proof of Work drains battery life on low-end mobile devices and can freeze older processors, alienating legitimate users in developing nations. Similarly, monetary friction excludes unbanked populations.
Friction must be dynamic. Telemetry should be used to establish a risk score.
- Low-risk traffic receives zero friction.
- Suspicious traffic receives a computational challenge.
- Only highly anomalous traffic (or traffic attempting high-value actions) faces monetary friction or strict cryptographic attestation like WebAuthn.