{"id":22333,"date":"2026-08-05T13:07:51","date_gmt":"2026-08-05T13:07:51","guid":{"rendered":"https:\/\/cryptoted.net\/index.php\/2026\/08\/05\/announcing-a-trillion-dollar-security-grant-for-webcat\/"},"modified":"2026-08-05T13:07:51","modified_gmt":"2026-08-05T13:07:51","slug":"announcing-a-trillion-dollar-security-grant-for-webcat","status":"publish","type":"post","link":"https:\/\/cryptoted.net\/index.php\/2026\/08\/05\/announcing-a-trillion-dollar-security-grant-for-webcat\/","title":{"rendered":"Announcing a Trillion Dollar Security grant for WEBCAT"},"content":{"rendered":"


\n<\/p>\n

\n

The Ethereum Foundation\u2019s Trillion Dollar Security (1TS) initiative is proud to announce a grant allocation to Freedom of the Press Foundation<\/a> (FPF) to support the continued development of WEBCAT<\/a>. WEBCAT is an open source tool that lets browsers verify that code served by an enrolled website matches what its developers published. The grant will also help bring that protection to Ethereum wallets and apps.<\/p>\n

<\/g><\/svg><\/a>Closing the front-end verification gap<\/h2>\n

The grant targets a gap in how web applications are secured today. HTTPS authenticates the site you connect to and encrypts the connection, but it does not prove that the code the site serves matches what its developers published. Without an independent integrity check, a browser can run an altered front end without warning.<\/p>\n

For Ethereum users, the risk lies in the app\u2019s website itself. Your browser loads and executes the site\u2019s code when you visit. Tampered code there can swap the recipient address or ask you to sign something other than what the page showed. Your wallet cannot determine from the connection alone whether the page has been altered.<\/p>\n

Trillion Dollar Security has identified front-end hacks as an infrastructure risk and verifiable front ends as a next step. Compromised web interfaces can expose users to supply-chain attacks and UI manipulation, and can increase the impact of incidents like DNS hijacks.<\/p>\n

<\/g><\/svg><\/a>About WEBCAT<\/h2>\n

WEBCAT, short for web-based code assurance and transparency, lets a browser verify that the resources served by an enrolled site match a signed manifest. If verification fails, the current alpha Firefox extension prevents the page from loading and displays a warning.<\/p>\n

Developers sign a manifest describing the files and other assets covered by each release. A distributed, verifiable enrollment system maintains a public record. For each participating site, that record holds a cryptographic fingerprint of enrollment information that specifies the site\u2019s authorized signing identities and validation rules. The extension periodically downloads and verifies a snapshot of the record, so it can verify enrolled sites locally without contacting a third party on every visit.<\/p>\n

FPF developed WEBCAT in part because a future version of SecureDrop will need verifiable browser code. SecureDrop<\/a> is FPF\u2019s open source submission system for secure communication between journalists and anonymous sources.<\/p>\n

Today, SecureDrop encrypts submissions on the newsroom\u2019s server as they are uploaded. The server handles unencrypted content during upload but stores submissions in encrypted form. FPF is developing an end-to-end encryption protocol for a future version of SecureDrop. Under the intended design, the source\u2019s browser would encrypt message content before sending it, so the server would store ciphertext rather than hold plaintext in memory until encrypted by the server. The protocol remains under development and does not yet cover file attachments.<\/p>\n

Because the encryption code would still come from the server, a compromised server could send altered code that captures content before encryption. WEBCAT is intended to detect and block that kind of alteration. FPF has also tested WEBCAT with other browser-based secure applications through proof-of-concept integrations.<\/p>\n

The same code-integrity risk applies when Ethereum users interact with browser-based app front ends, which is why a tool built to protect sources and journalists also fits wallets and apps.<\/p>\n

<\/g><\/svg><\/a>What the grant funds<\/h2>\n

The grant funds the development of a WEBCAT verification library that wallets can integrate.<\/p>\n

A wallet that includes the library can verify enrolled sites, so users get the protection without installing a separate extension. The grant also funds research into supporting Chrome and other Chromium browsers, help for teams adding WEBCAT to their apps, an independent security audit, and an Ethereum Request for Comments (ERC) standard ERC so wallet developers have a standard to follow.<\/p>\n

The library will complement other 1TS work, including Clear Signing<\/a>. Clear Signing helps users understand what they\u2019re approving, while WEBCAT integration would help wallets verify that an enrolled app\u2019s front end matches its signed manifest.<\/p>\n

<\/g><\/svg><\/a>What\u2019s next for wallet and app teams<\/h2>\n

Bringing this verification into wallets requires adoption on both sides. Wallet extensions must integrate the library, and app teams must enroll their domains and serve a signed manifest with each release. If you\u2019re part of a wallet or app team interested in front-end integrity, we\u2019d love to hear from you at trilliondollarsecurity@ethereum.org<\/a>.<\/p>\n

Read more about risk controls and priority work at trilliondollarsecurity.org<\/a>.<\/p>\n<\/div>\n


\n
Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

The Ethereum Foundation\u2019s Trillion Dollar Security (1TS) initiative is proud to announce a grant allocation to Freedom of the Press Foundation (FPF) to support the continued development of WEBCAT. WEBCAT is an open source tool that lets browsers verify that code served by an enrolled website matches what its developers published. The grant will also […]<\/p>\n","protected":false},"author":6,"featured_media":20792,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[24],"tags":[],"kronos_expire_date":[],"class_list":["post-22333","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ethereum"],"_links":{"self":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/22333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/comments?post=22333"}],"version-history":[{"count":0,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/22333\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media\/20792"}],"wp:attachment":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media?parent=22333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/categories?post=22333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/tags?post=22333"},{"taxonomy":"kronos_expire_date","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/kronos_expire_date?post=22333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}