The Ethereum Foundation has awarded a grant to the Freedom of the Press Foundation to develop WEBCAT, a browser-verification tool designed to prevent front-end tampering attacks that redirect funds or forge user signatures. The grant, distributed through the EF's Trillion Dollar Security initiative, funds a verification library for wallet integration, Chrome browser research, a security audit, and a new Ethereum Request for Comments standard.
Front-end attacks exploit the gap between what users see on screen and what code actually executes. A tampered interface can display one recipient address while submitting transactions to another, or present one message for signing while embedding an entirely different payload in the signature request. WEBCAT closes that gap by letting browsers cryptographically verify that a website's code matches the version published by its developers.
The tool originated at the Freedom of the Press Foundation as a protection layer for SecureDrop, the encrypted whistleblower submission platform used by major newsrooms including The New York Times, ProPublica and The Washington Post. SecureDrop's journalists accept anonymous tips through a system designed to hide the source's location and identity; a compromised version could expose the submitter before encryption takes hold.
Wallet providers face the same exposure. MetaMask, Uniswap, OpenSea and other applications that handle signing requests or transaction approvals are frequent targets for DNS hijacking, certificate spoofing and server compromises. A user connecting to a legitimate-looking domain may be interacting with injected code that reads private keys or confirms transfers to attacker addresses before the wallet's own security checks can intervene.
The EF announcement details the grant within its Trillion Dollar Security initiative, launched in 2025, which has distributed millions to projects addressing consensus-layer risks, smart contract verification and infrastructure hardening. The WEBCAT grant extends that scope to user-facing security, embedding verification into the browser rather than relying on individual applications to detect tampering after the fact.
The new ERC standard will allow developers to publish signed metadata about their applications' code hashes and deployment versions in a machine-readable format compatible with WEBCAT's verification flow. Wallets and dApps that adopt the standard can be added to a registry the tool queries; browsers then compare live code against the registry entry and flag mismatches before users interact with the site.
The grant covers research into native Chrome support, which would move verification from a browser extension to the browser engine itself, reducing the attack surface for the verification tool itself. A security audit of WEBCAT's library will precede its release for wallet integration.
The EF has invested in press-freedom infrastructure alongside major crypto foundations that fund projects beyond finance. Wikimedia Foundation and Electronic Frontier Foundation have both received substantial grants from blockchain-based funds in recent years. Whistleblowers, dissidents and users of financial applications all depend on systems that prove code integrity.
The timeline for Chrome integration and the audit remains unspecified. Wallet developers can begin integrating the verification library once it is released; adoption will determine whether WEBCAT becomes a standard check across wallets or remains a niche layer.
