# Third-party notices

## XMRig

The launcher interoperates with XMRig, an independent open-source mining engine maintained at <https://github.com/xmrig/xmrig> and documented at <https://xmrig.com/docs/miner>.

XMRig is licensed under the GNU General Public License version 3. GPL-3.0 permits use, modification, and redistribution, including commercial redistribution, subject to its conditions. A distributor of XMRig object code must preserve the applicable notices and license and provide the corresponding source in a GPL-compliant manner.

The BMM launcher and release ZIP do not contain or modify an XMRig binary. At the user's request, their computer downloads an official unmodified binary release directly from the XMRig project's GitHub release and verifies its published SHA-256 checksum. XMRig's own license, copyright notices, and source remain available from the upstream project.

Official XMRig builds include a default 1% developer donation. This release leaves that value at 1% and discloses it in the interface.

## SRBMiner-MULTI

The launcher interoperates with the independently maintained SRBMiner-MULTI engine distributed at <https://github.com/doktor83/SRBMiner-Multi> and <https://www.srbminer.com/>. SRBMiner-MULTI is proprietary binary software and is not represented by BMM as open source. As reviewed on 2026-08-30, its official repository publishes binaries, parameters, and documentation but no open-source license or broad commercial redistribution grant.

The launcher and release ZIP do not contain an SRBMiner-MULTI binary. When the user selects a supported SRBMiner workflow, the launcher downloads the official release on demand and verifies the GitHub asset SHA-256 when provided or the archive digest published by the upstream release. Upstream terms and notices remain applicable.

The current upstream SRBMiner package includes `WinRing0x64.sys`. Microsoft identifies WinRing0 as a valid vulnerable-driver detection associated with CVE-2020-14979, and the current SRBMiner build may not start while it remains quarantined. BMM therefore discloses the risk and documents a manual, individual Restore then Allow on device flow after archive verification. BMM does not silently allow the driver, create a folder exclusion or weaken antivirus protection.

SRBMiner-MULTI lists algorithm-specific developer fees for the GPU routes exposed by this release, ranging from 0.65% to 2%. The launcher shows the selected algorithm's upstream fee separately from the transparent 1% BMM time-based fee. Payment of an upstream developer fee is a mining-runtime mechanism and is not treated by BMM as permission to copy, rehost, rebrand, or commercially redistribute the engine.

This direct-official-download design reduces redistribution risk but is not represented as permission from the SRBMiner-MULTI author. Written permission should be obtained before a paid public BMM launch that depends on this engine. If permission is unavailable, the GPU routes should move to engines whose licenses expressly permit the intended commercial distribution model.

## MO-Miner

The launcher interoperates experimentally with MO-Miner, maintained at <https://github.com/MoneroOcean/mo-miner> under GPL-3.0-or-later. BMM does not bundle or rehost MO-Miner. Selecting Beam, Karlsen, or a compatible Advanced-mode alternative downloads the official unmodified release archive on demand and requires the SHA-256 supplied in the GitHub release asset metadata.

MO-Miner's Windows archive is large because it includes cross-vendor GPU runtimes. BMM selects one eligible discrete-GPU vendor, excludes recognized integrated graphics and does not run MO-Miner's optional administrator installer or silently change drivers and toolchains. The current adapter is experimental, has log-based statistics, discloses MO-Miner's default 1% developer donation and does not yet enable backup-pool failover.

## BzMiner

The launcher interoperates experimentally with BzMiner, maintained at <https://github.com/bzminer/bzminer>. Its current repository describes the rewritten engine as a public beta and does not publish a broad open-source or commercial integration licence. BMM does not bundle, copy or rehost its binary.

When Warthog is selected, BMM downloads the unmodified official v100.04b1 archive on demand and verifies the SHA-256 published on that release before extraction. This reviewed version was chosen because its release notes include Warthog fixes around developer-fee and pool switching. The pin prevents a later unreviewed public-beta build from being run automatically.

Warthog requires a GPU and CPU simultaneously, and BzMiner declares a separate 2% Warthog developer fee. The launcher exposes Warthog only as a combined CPU + GPU Early Access route, binds BzMiner's unauthenticated monitoring interface to `127.0.0.1`, and applies an 85 C engine safety limit. BzMiner may calibrate the CPU/GPU balance for roughly two minutes after startup. BMM counts neither user nor BMM active-mining time until a positive hashrate or accepted share is observed.

Official runtime download and payment of an upstream fee are not represented as permission for a paid commercial wrapper. Written confirmation of the intended integration terms should be obtained before a paid production launch.

## Mining pools

HashVault, SupportXMR, Nanopool, LuckyPool, LuckPool, HeroMiners, Kryptex, 2Miners, FlockPool, WoolyPooly, zpool, RPlant, Cedric-Crispin, EthCore, KriptoKyng, Pooly.ca, MeowPool, the official Neoxa pool, ZanoPool, K1Pool, MinerLab and any custom pool selected by a user are independent services. Their names and links are provided for interoperability and do not imply ownership, endorsement, partnership, or guaranteed availability. Pool fees, minimum payouts, endpoints, and terms can change.

Minerstat pool pages are used as a discovery and comparison source, not as an endorsement or an automatic source of launcher configuration. Each integrated endpoint is reviewed against a current first-party pool, operator, coin-project or miner configuration source before inclusion. The review sources and limitations are listed in `POOL_SOURCES.md`.

## Reviewed but excluded engine candidates

GMiner is excluded. Its current official EULA prohibits redistribution and specifically restricts wrapper software from substituting its own automatic download flow for the author's distribution. lolMiner and miniZ are not represented as open-source engines or as approved BMM integrations because a sufficiently clear commercial wrapper/download permission has not been confirmed. An official runtime download by itself does not establish commercial-integration or redistribution permission.

Qubic's official reference Qiner and third-party pool builds are not included or invoked by this release. The official Qiner command flow requires signing and mining seeds, which BMM will never collect, store or pass. Other clients that can use a public payout ID still need an explicit compatible license and integrity-verifiable epoch trainer design. A future Qubic route therefore requires written integration permission plus a public-ID-only security model.

## Build tooling

The Windows executable is produced with Node.js and `@yao-pkg/pkg`. Their applicable licenses and dependency notices are included in the source dependency metadata generated by npm.
