Ethereum Foundation Funds WEBCAT Development to Enhance Wallet Security

ME News reports that on August 5 (UTC+8), the Ethereum Foundation’s Trillion Dollar Security (1TS) initiative announced a grant (amount undisclosed) to the Freedom of the Press Foundation (FPF) to support the ongoing development of the open-source tool WEBCAT, which enables browsers to verify whether the code provided by a website matches the version released by its developers. This grant will also advance the application of this protection mechanism to Ethereum wallets and applications. WEBCAT addresses the gap in frontend verification: while HTTPS ensures connection security, it cannot guarantee that the code served by a website is identical to the version published by developers. Maliciously altered frontend code could replace payment addresses or trick users into signing unintended transactions. Developers must sign a manifest file with each release; a distributed, verifiable registry maintains a public record, and browser extensions periodically download and verify snapshots of this record to perform local validation. The current Firefox extension, in alpha stage, blocks page loading and displays a warning upon verification failure. FPF developed WEBCAT in part because future versions of its SecureDrop secure submission system require verifiable browser code. This grant will fund the development of a WEBCAT verification library for wallet integration, support research into compatibility with Chromium-based browsers such as Chrome, conduct independent security audits, and draft an Ethereum Request for Comments (ERC) standard for wallet developers to follow. This verification library will complement 1TS’s previously released Clear Signing feature. (Source: Foresight News)