The Ethereum Foundation’s Ecosystem Support Program has awarded a grant to the Freedom of the Press Foundation to build WEBCAT, a project focused on making web application frontends verifiable and censorship-resistant. The tool is designed to let users confirm that the code running in their browser is actually the code developers intended to ship.
What WEBCAT actually does
The project focuses on in-browser code verification. In English: it gives your browser a way to check that the JavaScript, HTML, and other code being served to you matches what the developers published. If someone, whether a malicious actor, a compromised server, or even a coerced hosting provider, swaps out the real frontend for a poisoned version, WEBCAT would flag it.
This matters enormously for Ethereum wallets and dApps, where a compromised frontend can drain funds without ever touching the smart contract layer. Some of the most damaging crypto exploits in recent years haven’t been smart contract hacks at all. They’ve been frontend attacks, DNS hijacks, and supply chain compromises that served users malicious interfaces while the underlying protocols remained perfectly intact.
The project maintains public documentation at docs.webcat.tech and open-source repositories under the freedomofpress GitHub organization.
Why the Freedom of the Press Foundation
The Freedom of the Press Foundation is a non-profit best known for SecureDrop, the open-source whistleblower submission system used by newsrooms around the world. FPF has spent years solving a closely related problem: how do you ensure that the software a source uses to submit sensitive documents hasn’t been tampered with? WEBCAT extends that same philosophy to browser-based applications.
Both SecureDrop and Ethereum dApps face adversaries who would benefit from silently modifying the code users interact with. For SecureDrop, that adversary might be a state actor targeting journalists. For Ethereum wallets, it’s anyone who wants to redirect transactions or steal private keys. The technical challenge, verifying that client-side code hasn’t been altered, is fundamentally the same.
The bigger security picture for Ethereum
The specific grant amount has not been disclosed. That’s fairly standard for ESP allocations, which tend to keep financial details private while making the work itself public through open-source repositories and documentation.
The attack surface for decentralized applications isn’t limited to on-chain code. It extends through oracles, bridges, RPC providers, DNS registrars, CDN services, and yes, the JavaScript bundles served to users’ browsers. Most users have no way to verify that the interface they’re looking at is legitimate beyond checking the URL, which itself can be spoofed through DNS attacks.