The Ethereum Foundation’s Trillion Dollar Security initiative has awarded a grant to the Freedom of the Press Foundation to advance WEBCAT, an open-source system for verifying website code. The funding targets a security layer that smart-contract audits cannot protect: the browser interface through which users prepare and approve transactions. The Foundation did not disclose the grant amount or a deployment timetable.
A compromised decentralized application can display one action while preparing another, including replacing a recipient address or requesting an unintended signature. HTTPS secures the connection to a website, but it does not prove that the delivered code matches the release approved by its developers. WEBCAT is designed to detect that integrity gap before altered resources execute in the browser.
Signed Manifests Create an Independent Code Check
WEBCAT, short for web-based code assurance and transparency, compares the resources served by an enrolled website with a developer-signed manifest. A distributed and verifiable enrollment system records authorized signing identities and validation rules, while the client periodically downloads a snapshot that can be checked locally. If the code or its execution environment fails verification, the current Firefox extension blocks the affected page instead of merely displaying a passive warning.
The tool is currently available as an alpha Firefox extension, and the grant will support research into Chrome and other Chromium-based browsers. It will also finance technical assistance for application teams, an independent security audit and further standards work. The immediate objective is broader integration, not a claim that WEBCAT already protects Ethereum users by default.
A central component will be a verification library that wallet developers can embed directly. That approach would allow a wallet to check enrolled sites without requiring each user to install a separate browser extension. Protection will still depend on adoption by both sides: wallets must integrate the library, while application teams must enroll their domains and publish signed manifests for each release.
Wallet Verification Complements Clear Signing
The Foundation positions WEBCAT as complementary to Clear Signing, its separate effort to present transaction effects in a structured, human-readable form. Clear Signing helps a user understand the action being approved, while WEBCAT aims to confirm that the application generating that action has not been silently modified. Together, the systems address different stages of the same approval risk.
Freedom of the Press Foundation originally developed WEBCAT partly for a future version of SecureDrop, its open-source platform for confidential communication between journalists and sources. FPF is working toward browser-side encryption, but code delivered by a compromised server could capture content before encryption occurs. The same verification model applies to Ethereum front ends that handle wallet connections and transaction requests.
The grant will also support development of an Ethereum Request for Comments standard for wallet implementations. That work remains prospective, and no finalized ERC or broad production rollout has been announced. WEBCAT’s significance will depend on independent review, wallet adoption and enrollment by major applications, rather than the grant alone.