Skip to content

Back to the catalog

Announcing a Trillion Dollar Security grant for WEBCAT
blog.ethereum.orgarticle

Announcing a Trillion Dollar Security grant for WEBCAT

The Ethereum Foundation's Trillion Dollar Security initiative is funding Freedom of the Press Foundation's continued development of WEBCAT, an open-source browser extension that verifies served front-end code against a developer-signed manifest and a distributed enrollment record, blocking page loads when the code has been tampered with. The grant funds a wallet-integrable verification library, Chromium support research, an independent security audit, and an ERC standard so wallets can detect front-end supply-chain compromise (e.g., altered recipient addresses or signing prompts) without a separate extension. WEBCAT was originally built to protect FPF's SecureDrop from a compromised server serving altered client-side encryption code.

TL;DR Ethereum Foundation grant funds WEBCAT, a signed-manifest browser code-integrity tool, for integration into wallets to close the front-end tampering gap HTTPS doesn't cover.
Open original ↗
Document

What it is

An Ethereum Foundation Trillion Dollar Security grant to Freedom of the Press Foundation for WEBCAT. The summary lists what the grant funds; what it does not say is the current maturity: WEBCAT today is an alpha Firefox extension only. Chrome/Chromium support is funded research, and the wallet-integrable library, the audit, and the ERC standard are deliverables of this grant, not shipped artifacts. An engineer looking to adopt it now has nothing to integrate yet.

How it works

Developers sign a manifest listing the files/assets in each release. A distributed, verifiable enrollment record holds, per site, a cryptographic fingerprint of that site's authorized signing identities and validation rules. The extension periodically downloads and verifies a snapshot of the record, so it checks enrolled sites locally without contacting a third party on each visit. On verification failure the alpha extension blocks the page load and shows a warning.

What to do

Adoption is two-sided and neither side can act unilaterally: wallet extensions must integrate the (future) library, and app teams must enroll their domains and serve a signed manifest with every release. Teams interested can contact trilliondollarsecurity@ethereum.org. WEBCAT is positioned to complement Clear Signing, not replace it.

Caveats

The SecureDrop E2E protocol that motivates this remains under development and does not yet cover file attachments.

Organisations named here

  • ERC
  • Freedom of the Press Foundation
  • Trillion Dollar Security

Technologies named here

  • Ethereum wallets
  • WEBCAT
  • Ethereum apps
  • Clear Signing
  • SecureDrop
  • Ethereum
  • Firefox
  • Chrome

Techniques named here

  • DNS hijacks

Related in AppSec