Announcing a Trillion Dollar Security grant for WEBCAT

The Ethereum Foundation’s Trillion Dollar Security (1TS) initiative has allocated a grant to the Freedom of the Press Foundation (FPF) to support the development of WEBCAT, an open-source tool designed to verify that code served by enrolled websites matches what developers published. The grant will extend this protection to Ethereum wallets and applications, addressing a critical gap in web security where HTTPS alone cannot confirm code integrity. Without independent verification, compromised front-end code could manipulate transactions or deceive users, posing risks to Ethereum users interacting with browser-based apps.

WEBCAT, short for web-based code assurance and transparency, enables browsers to verify that resources served by enrolled sites align with a signed manifest. The current alpha Firefox extension blocks pages failing verification and displays warnings. Developers sign manifests for each release, while a distributed enrollment system maintains a public record of cryptographic fingerprints for authorized signing identities and validation rules. The extension periodically checks this record locally, ensuring verification without third-party dependency on every visit.

FPF developed WEBCAT in part to support a future version of SecureDrop, its open-source submission system for secure journalist-source communication. The planned end-to-end encryption protocol for SecureDrop would encrypt messages in the source’s browser before submission, but a compromised server could still send altered code to capture unencrypted content. WEBCAT is intended to detect and block such alterations, ensuring the integrity of the encryption process. FPF has also tested WEBCAT with other secure browser-based applications, demonstrating its broader applicability beyond SecureDrop.

The grant will fund the development of a WEBCAT verification library for wallet integration, eliminating the need for users to install a separate extension. Additional funding supports research for Chrome and Chromium browser compatibility, assistance for teams adopting WEBCAT, a security audit, and the creation of an Ethereum Request for Comments (ERC) standard for wallet developers. The library will complement other 1TS initiatives, such as Clear Signing, which focuses on user transaction understanding, while WEBCAT ensures enrolled app front ends match their signed manifests.