Ethereum Foundation funds a front-end integrity tool built for journalists, aimed at wallets

The Ethereum Foundation said on August 5 that its Trillion Dollar Security initiative has awarded a grant to the Freedom of the Press Foundation to continue development of WEBCAT, an open source system that lets a browser check whether the code a website serves matches what its developers signed and published. The foundation did not disclose the size of the grant or a delivery date.

WEBCAT — short for web-based code assurance and transparency — targets a gap the Ethereum Foundation describes plainly in its announcement: HTTPS proves which server you reached and encrypts the connection, but proves nothing about whether the code that server sent is the code the developers shipped. A browser will execute an altered front end without complaint. For a wallet user, that means a tampered page can swap a recipient address or present one action while requesting a signature for another, and the wallet has no way to tell from the connection alone.

The mechanics, per the foundation's post: developers sign a manifest covering the files and assets in each release. A distributed enrollment system keeps a public record holding a cryptographic fingerprint of each enrolled site's authorized signing identities and validation rules. The browser extension periodically downloads and verifies a snapshot of that record, so checks happen locally rather than by phoning a third party on each visit. In the current alpha — a Firefox extension — a failed check blocks the page and shows a warning.

The grant funds a verification library wallets can embed directly, removing the separate-extension requirement; research into Chrome and other Chromium browsers; integration support for app teams; an independent security audit; and an ERC standard so wallet developers have something uniform to build against. The foundation positions it alongside its Clear Signing work: Clear Signing tells you what you're approving, WEBCAT is meant to tell you the page asking is authentic.

The journalism origin is not incidental. FPF built WEBCAT because a future version of SecureDrop, its anonymous-submission system for newsrooms, is being redesigned so the source's browser encrypts content before sending it. Since that encryption code still arrives from the server, a compromised server could serve code that captures plaintext first. The foundation notes that protocol is still under development and does not yet cover file attachments.

Key facts

• Grantor: Ethereum Foundation's Trillion Dollar Security initiative; recipient: Freedom of the Press Foundation (Ethereum Foundation blog, Aug 5, 2026)
• Grant amount and timeline: not disclosed
• Current state: alpha Firefox extension; blocks page load on verification failure (Ethereum Foundation blog)
• Funded scope: wallet-integrable library, Chromium support research, integration help, independent security audit, an ERC standard (Ethereum Foundation blog)
• SecureDrop end-to-end encryption protocol: still in development, no file-attachment coverage (Ethereum Foundation blog)

The real-world read

This is the funder announcing its own grant, so read the framing accordingly — it is the Ethereum Foundation's case for the Ethereum Foundation's security program, not independent assessment. Three things are conspicuously absent. There is no dollar figure. There is no ship date. And no wallet or app team is named as committed to integrating; the post closes by inviting interested teams to email trilliondollarsecurity@ethereum.org, which reads like recruitment rather than a rollout.

The technical caveats are stated but easy to skim past. The working product is an alpha, on one browser. Chromium — where most users are — is funded as research, not as a deliverable. And the design needs adoption on both sides: wallets must embed the library, and app teams must enroll domains and sign a manifest every release. Neither half is useful without the other, and the announcement offers no evidence either half exists yet at scale.

The foundation asserts front-end hacks are an infrastructure-level risk but cites no incident count, loss figure or dataset to size it. That may well be true — DNS hijacks and interface swaps have a long history in this sector — but it is here an assertion, not a demonstration.

Opinion, and whose

The claim that verifiable front ends are "a next step" for Ethereum security, and that a tool built for journalists' sources also fits wallets, is the Ethereum Foundation's own position as stated in its post. No outside security researcher, wallet vendor or auditor is quoted assessing WEBCAT's design or the size of the problem it addresses.

Sources

• Ethereum Foundation blog (Aug 5, 2026), "Announcing a Trillion Dollar Security grant for WEBCAT" — primary and sole source for the grant, WEBCAT's architecture, funded deliverables, current alpha status, and the SecureDrop background. As the grantor's own announcement, it is an interested party's account: promotional in intent, though specific and candid about the tool's alpha status and its adoption dependencies.

Nothing here is financial advice.