# Ethereum Foundation Announces $1 Trillion Security Grant for WEBCAT

WEBCAT aims to close the front-end verification gap for Ethereum wallets and applications.

- **Source:** [Ethereum Foundation Blog](https://brifing.si/source/6df1687c-b12e-48e1-8d29-dcb01675c35c)
- **Published:** 2026-08-05
- **Original article:** <https://blog.ethereum.org/en/2026/08/05/1ts-grant>
- **On Brifing:** https://brifing.si/s/59a50927-1255-4811-bedb-070363c0e469

## $1 Trillion Security Grant

The Ethereum Foundation has awarded a grant to the Freedom of the Press Foundation (FPF) to support the development of WEBCAT. WEBCAT is an open-source tool that allows browsers to verify that the code served by a website matches what its developers published. This grant also aims to provide similar protection for Ethereum wallets and apps. Announced on August 5, 2026, the grant is part of the Trillion Dollar Security (1TS) initiative.

## The Front-End Verification Gap

HTTPS encrypts connections and authenticates site identity but does not prove whether the served code is original. This gap allows modified front-end code to run in browsers without warning. For Ethereum users, the risk lies in the app's website itself. When you visit a site, your browser loads and executes its code. Altered code could change recipient addresses or prompt you to sign something different from what the page displays.

## How WEBCAT Works

WEBCAT (web-based code assurance and transparency) enables browsers to verify whether resources served by an enrolled site match a signed manifest. If verification fails, the Firefox extension blocks the page from loading and displays a warning. Developers sign a manifest describing files and assets in each release. A distributed enrollment system maintains and verifies this information. The extension periodically downloads a snapshot of this record, allowing local verification without third-party contact on each visit.

## SecureDrop and WEBCAT

FPF developed WEBCAT partly for future versions of SecureDrop, its open-source system for secure communication between journalists and anonymous sources. Currently, SecureDrop encrypts submissions on newsroom servers during upload. FPF is developing an end-to-end encryption protocol where the source's browser encrypts content before sending it. WEBCAT will prevent servers from capturing unencrypted content by detecting and blocking code alterations.

## Risks for Ethereum Applications

Ethereum users face similar code integrity risks when interacting with browser-based app front-ends. Although built for journalists and sources, WEBCAT also suits wallets and apps. Front-end hacks can expose users to supply-chain attacks and UI manipulation, amplifying the impact of incidents like DNS hijacking. WEBCAT provides a solution to verify front-end integrity in decentralized applications.

## Grant Scope

The grant funds development of a WEBCAT verification library for wallet integration. Wallets with this library can verify enrolled sites, offering protection without requiring separate extensions. Additional funding covers Chrome/Chromium support, assistance for teams adding WEBCAT to apps, an independent security audit, and an Ethereum Request for Comments (ERC) standard. This standard will guide wallet developers in implementation.

## Complementing Clear Signing

The WEBCAT library will complement other 1TS projects like Clear Signing. While Clear Signing helps users understand what they're approving, WEBCAT integration lets wallets verify that an app's front-end matches its signed manifest. Together, these technologies enhance Ethereum ecosystem security. WEBCAT plays a critical role in ensuring front-end integrity for decentralized applications.

## Next Steps for Wallet and App Teams

Adopting this verification requires participation from both sides. Wallet extensions must integrate the library, while app teams need to enroll domains and serve signed manifests with each release. The Ethereum Foundation invites wallet or app teams interested in front-end integrity to contact trilliondollarsecurity@ethereum.org. More details on risk controls and priority work are available at trilliondollarsecurity.org.

## Sources covering this story

- https://blog.ethereum.org/en/2026/08/05/1ts-grant — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._