The Ethereum Foundation’s Trillion Dollar Security (1TS) initiative has awarded a development grant to the Freedom of the Press Foundation (FPF) to expand WEBCAT, an open-source security tool designed to verify front-end code integrity. The funding is intended to adapt WEBCAT's code verification framework for Ethereum wallets and decentralized applications, addressing critical vulnerabilities in browser-based Web3 interfaces.

Front-end security remains a significant challenge across the crypto ecosystem. Although standard HTTPS protocols encrypt network traffic and confirm site ownership, they do not verify whether the code served by a website matches the source code published by its developers. As a result, users visiting decentralized application front ends can unknowingly execute altered scripts. Compromised web interfaces can manipulate user interface elements, substitute destination addresses, or prompt users to sign harmful transaction requests that differ from what is displayed on screen.

WEBCAT, which stands for web-based code assurance and transparency, mitigates these front-end risks by allowing browsers to verify site resources against a signed developer manifest. A distributed enrollment system records cryptographic fingerprints of authorized signing keys and validation rules. The tool's alpha Firefox extension periodically updates local snapshots of these records to perform integrity checks without querying third-party servers on every page load. If code validation fails, the extension prevents the site from loading and displays an alert.

The Freedom of the Press Foundation originally created WEBCAT to protect SecureDrop, an open-source submission system used by news organizations and anonymous sources. Because FPF is building end-to-end encryption for SecureDrop where the browser encrypts content before upload, WEBCAT was designed to block compromised servers from injecting malicious code that could capture unencrypted message data. Recognizing that Ethereum app users face identical client-side code risks, 1TS selected WEBCAT to bring similar protections to Web3.

The new grant specifically funds the creation of a standalone WEBCAT verification library that crypto wallet extensions can embed directly, providing built-in integrity checks without requiring users to install auxiliary software. The grant also supports research into extending compatibility to Google Chrome and other Chromium browsers, onboarding assistance for dApp developers, an independent code audit, and the drafting of a new Ethereum Request for Comments (ERC) standard for standardized wallet implementation.

This security integration works alongside other 1TS projects, including Clear Signing initiatives that help users understand transaction payloads prior to signing. While Clear Signing ensures users comprehend what they approve, WEBCAT ensures that the front-end software presenting the transaction has not been altered. Full deployment across the network will require wallet developers to adopt the integration library and application teams to enroll their domains with signed release manifests.