The Ethereum Foundation’s Trillion Dollar Security initiative is funding WEBCAT, an open-source front-end integrity tool from Freedom of the Press Foundation, so wallets and apps can check that the browser code you load matches what developers published. HTTPS alone does not do that. For Ethereum users who click through DeFi sites every day, that gap is the story.
Ether was near $1,906 on our CoinGecko snapshot at , up about 1.8% over 24 hours, while Bitcoin sat near $64,574. The price tape is quiet. The security tape is not.
What happened
On , the Ethereum Foundation Access Cluster posted that the Trillion Dollar Security (1TS) program is allocating a grant to Freedom of the Press Foundation for continued WEBCAT development, with a clear aim: bring browser code verification into Ethereum wallets and apps.
WEBCAT stands for web-based code assurance and transparency. In plain terms, enrolled sites publish a signed manifest of the files they intend to serve. A browser extension (today an alpha for Firefox) checks that what arrives matches that manifest. If verification fails, the page is blocked and a warning shows. The enrollment record is designed so the extension can verify locally from a verified snapshot, rather than phoning home on every visit.
The grant is not a vague research stipend. Per the Foundation post, it funds a verification library wallets can integrate (so users do not need a separate extension), research toward Chrome and other Chromium browsers, help for teams enrolling their apps, an independent security audit, and an ERC so wallet developers have a shared standard. It is meant to sit next to other 1TS work such as Clear Signing: one line of defense for “what am I approving,” another for “is this the front end the team says it is.”
The public repo for the project lives under Freedom of the Press Foundation at github.com/freedomofpress/webcat, described as a framework for blocking code signing, integrity, and transparency checks for browser-based applications. The initiative’s wider security map is tracked at trilliondollarsecurity.org, where User Experience sits as the first of six risk dimensions.
Context
Most Ethereum “hacks” that hit retail users are not consensus failures. They are interface failures. You open a familiar URL, the padlock is green, and the page asks you to sign. Your wallet can only see the connection and the payload. It cannot tell, from HTTPS alone, whether a DNS hijack, a CDN compromise, or a poisoned deploy swapped the JavaScript that draws the “Send” button.
That is why the Foundation frames front-end hacks as infrastructure risk inside 1TS. WEBCAT’s origin story makes the same point from another industry: Freedom of the Press Foundation built it partly because a future SecureDrop design wants the source’s browser to encrypt before upload. If the encryption code itself is served by a compromised server, the server can still steal content before encryption. Verifying the front end is the missing check. Browser wallets face a sibling problem every time you connect a hot wallet to a DeFi site.
Usage context matters here. DefiLlama’s Ethereum fee overview, read at about , showed roughly $8.5 million in fees over the prior 24 hours (about 15% lower than the prior day) and about $41.6 billion in Ethereum TVL on the chains endpoint at the same pull. DEX volume across DefiLlama’s tracked venues was about $6.9 billion in 24 hours. That is real money moving through browser UIs. Fee charts and TVL do not prove WEBCAT will ship fast. They do show why a front-end integrity standard is not a side quest if you care about Ethereum as settlement plumbing. For the longer arc of that plumbing, see our Ethereum history page.
This also sits next to the month’s custody scare on the Bitcoin side. Hardware seed failures and phishing front ends are different bugs, but both punish the same habit: treating “I opened the usual app” as proof the code is honest. Our Coldcard reaction covered one end of that spectrum. WEBCAT targets the other: the live web UI sitting in front of otherwise careful self-custody.
Our read
My stance: this grant is one of the more useful “security theater vs shipped mechanics” tells we have seen from the Foundation stack this summer. Show me the fee, not the roadmap, is still the rule. A named library, an audit budget, Chromium research, and an ERC draft path are closer to shipped mechanics than another awareness week.
I am not treating enrollment as solved. Adoption is a two-sided market. Wallet teams have to embed the library. App teams have to enroll domains and ship signed manifests on every release. Until both sides move, users still live on trust-plus-HTTPS. The alpha Firefox extension is a start, not coverage.
Falsifiable claim: by 6 November 2026, 23:59 UTC, either (a) the Ethereum Foundation or Freedom of the Press Foundation publishes a primary update confirming that at least one widely used browser wallet (MetaMask, Rainbow, or Rabby) has a production release note mentioning WEBCAT or the 1TS front-end verification library, or (b) an ERC for WEBCAT-style wallet verification is posted as a numbered draft on the EIPs repository or Ethereum Magicians. If neither appears by that deadline, this read was too optimistic about wallet-side integration speed.
What would not count as a win: another blog teaser, a private pilot with no public release note, or “coming soon” language without a version users can install.
What to watch next
First, watch for the verification library landing in a public wallet changelog. Release notes beat conference slides.
Second, watch enrollment: which DeFi and bridge front ends actually publish signed manifests. A short list of blue-chip apps matters more than a long list of demos. Category coverage on Ethereum news will pick up those announcements as they clear primary sources.
Third, watch the ERC process. A numbered draft gives wallet engineers something to implement against, instead of a one-off grant blog post.
Fourth, keep ordinary hygiene while the tooling catches up. Bookmark official domains, prefer hardware confirmation for large moves, and treat unexpected signature prompts as hostile until proven otherwise. Our guide on how to use a crypto wallet safely is still the baseline checklist.
Ethereum does not need perfect UX security overnight. It needs fewer silent front-end swaps between the padlock and the signature. WEBCAT is a concrete bet on that layer. I want the library in wallets users already open, not another extension most people will never install.