BankOfAI Pool — Reverse Engineering & Automated API Key Farm

Reverse engineering of chat.bankofai.io (a LobeChat white-label AI platform branded as "AINFT") with automated registration pipeline and API key pool management.

Table of Contents

• Project Overview
• How It Works — Registration Principle
• Architecture
• Base Chain Economics
• Configuration Guide
• Quick Start
• Dashboard Features
• API Proxy Usage
• Reports
• Disclaimer

Project Overview

BankOfAI is a LobeChat-based AI platform that gives new users 500,000 credits (≈ $0.50) upon wallet registration. This project:

1. Reverses their frontend authentication flow (SIWE-like wallet signatures, AES token encryption, tRPC calls)
2. Automates mass wallet registration → claim → API key generation
3. Pools hundreds of API keys behind a unified OpenAI-compatible proxy endpoint
4. Routes requests through LiteLLM to various models (GPT-5.4, Gemini 3.1 Pro, GLM-5, etc.)

How It Works — Registration Principle

Each account is created through a 6-step automated flow:

┌─────────────────────────────────────────────────────────────────────┐
│                     Registration Pipeline                             │
├──────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  1. Generate Wallet     ethers.Wallet.createRandom()                │
│         │               → new EVM address + private key              │
│         ▼                                                            │
│  2. Fund on Base L2     Funder wallet sends 0.00000000001 ETH       │
│         │               (10M wei dust) to pass their balance check   │
│         ▼                                                            │
│  3. Sign Login Msg      Construct SIWE-like message:                │
│         │               "Welcome to BANK OF AI !                     │
│         │                chat.bankofai.io wants to sign in with...   │
│         │                Chain ID: 0x1 / Expiration / Nonce"         │
│         │               → wallet.signMessage(msg)                    │
│         ▼                                                            │
│  4. next-auth Login     GET /api/auth/csrf → csrfToken              │
│         │               POST /api/auth/callback/metamask             │
│         │               → session-token cookie returned              │
│         ▼                                                            │
│  5. Claim Credits       Sign a DIFFERENT claim message:             │
│         │               "BANK OF AI welcome gift-claim               │
│         │                Account: 0x... / Chain ID: 0x1 / Nonce"     │
│         │               Forge AES to