Ethereum Foundation funds browser checks for wallet front ends
A grant to the Freedom of the Press Foundation will extend WEBCAT from an alpha Firefox extension toward wallet libraries, Chromium support and a proposed ERC standard.
The Ethereum Foundation's Trillion Dollar Security initiative is funding a new layer of checks for the code that wallets and blockchain apps send to a user's browser. In its Aug. 5 announcement, the foundation said a grant to the Freedom of the Press Foundation will support WEBCAT, an open-source tool that compares served web code with a developer-signed release manifest.
The problem sits above the blockchain. HTTPS authenticates a connection and encrypts traffic, but a secure connection can still deliver a modified front end. A compromised site could change the recipient address shown to a user or ask a wallet to sign a different transaction from the one displayed on screen. The ledger would record the signature; it would not explain how the browser got there.
How WEBCAT checks a release
WEBCAT lets an enrolled site publish a signed manifest describing the files and other assets in a release. A distributed enrollment record stores the site's authorized signing identities and validation rules. The current alpha Firefox extension downloads a snapshot of that record, checks the page locally and blocks the site with a warning when the fingerprints do not match.
That design targets a front-end supply-chain problem rather than a consensus failure. It can help a wallet notice that its web interface changed after a deployment or a domain compromise, while leaving the underlying Ethereum contracts untouched. The check is useful precisely because users usually cannot inspect the JavaScript that constructs a transaction request.
The adoption work is still ahead
The grant will fund a verification library for wallet integration, support for Chrome and other Chromium browsers, help for application teams, an independent security audit and work toward an ERC standard. That package would move the protection from a browser extension into wallets that can warn users during normal signing flows.
Wallet developers would need to integrate the library, and app teams would need to enroll their domains and sign every covered release. The system therefore creates a new operational duty alongside its security benefit: a broken manifest or lost signing key can interrupt access even when the application itself is healthy.
