The Ethereum Foundation has announced a new grant under its Trillion Dollar Security (1TS) initiative to support the development of WEBCAT, an open-source web security tool designed to protect users from tampered websites and front-end cyberattacks.
The grant has been awarded to the Freedom of the Press Foundation (FPF), which developed WEBCAT to verify that the code delivered by a website matches the code originally published by its developers. The initiative aims to improve security not only for journalists using secure communication platforms but also for Ethereum wallets and decentralized applications (dApps).
Addressing a Critical Security Gap
While HTTPS ensures encrypted communication between users and websites, it does not guarantee that the website’s code has not been altered.
According to the Ethereum Foundation, this creates a major security risk for crypto users. If hackers compromise a website’s front end, they can potentially change wallet addresses, manipulate transaction details, or trick users into approving malicious transactions—all without the wallet being able to detect the tampering.
The Foundation believes front-end attacks have become one of the most significant infrastructure risks in the Web3 ecosystem.
How WEBCAT Works
WEBCAT, short for Web-Based Code Assurance and Transparency, enables browsers to verify whether a website’s files match a cryptographically signed version published by its developers.
If the verification fails, the current Firefox extension blocks the website from loading and alerts the user that the site’s code may have been modified.
Instead of relying on a central authority, WEBCAT uses a distributed verification system that allows browsers to perform integrity checks locally without contacting third-party servers during every visit.
Originally Built for SecureDrop
The Freedom of the Press Foundation initially developed WEBCAT to strengthen SecureDrop, its secure communication platform used by journalists and anonymous sources.
FPF is working on adding end-to-end encryption to SecureDrop so that messages are encrypted directly in the user’s browser before reaching newsroom servers.
However, if attackers compromise the website itself, they could replace the encryption code with malicious code capable of stealing sensitive information before encryption occurs.
WEBCAT is designed to detect and prevent such attacks.
Grant to Expand Protection for Ethereum Ecosystem
The Ethereum Foundation’s grant will fund several new developments, including:
- A WEBCAT verification library that can be integrated directly into crypto wallets.
- Support for Chrome and other Chromium-based browsers.
- Technical assistance for developers implementing WEBCAT.
- An independent security audit.
- Development of a new Ethereum Request for Comments (ERC) standard to standardise wallet integration.
With direct wallet integration, users will no longer need to install a separate browser extension to benefit from front-end verification.
Part of Ethereum’s Trillion Dollar Security Initiative
The project complements the Ethereum Foundation’s broader Trillion Dollar Security (1TS) initiative, which focuses on strengthening security across the Ethereum ecosystem.
While other initiatives such as Clear Signing help users understand exactly what they are approving during crypto transactions, WEBCAT adds another layer of protection by verifying that the application’s website itself has not been compromised before users interact with it.
The Ethereum Foundation believes combining transaction transparency with front-end verification will significantly improve the security of Web3 applications as the ecosystem continues to grow.
Author
About the Author
