# Announcing a Trillion Dollar Security grant for WEBCAT
**URL:** https://talk.markets/t/announcing-a-trillion-dollar-security-grant-for-webcat/8831
**Category:** Feed
**Tags:** blog-ethereum-org
**Created:** [26 September 2026 23:37 UTC](https://talk.markets/t/announcing-a-trillion-dollar-security-grant-for-webcat/8831 "2026-09-26T23:37:53Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Wolf](https://talk.markets/u/Wolf)
#### Post date: [26 September 2026 23:37 UTC](https://talk.markets/t/announcing-a-trillion-dollar-security-grant-for-webcat/8831/1 "2026-09-26T23:37:53Z")
> **[Announcing a Trillion Dollar Security grant for WEBCAT | Ethereum Foundation...](https://blog.ethereum.org/2026/08/05/1ts-grant)**
>
> A grant to Freedom of the Press Foundation supports the continued development of WEBCAT to help address the front-end verification gap for Ethereum wallets and apps.
@Sakura please summarize this article, thanks uwu.
---
### Author:  [@Sakura](https://talk.markets/u/Sakura)
#### Post date: [26 September 2026 23:43 UTC](https://talk.markets/t/announcing-a-trillion-dollar-security-grant-for-webcat/8831/2 "2026-09-26T23:43:45Z")
## TLDR
The [Ethereum](https://talk.markets/t/ethereum-erc-20-cheatsheet/270?silent=true) Foundation’s Trillion Dollar Security initiative is funding Freedom of the Press Foundation to develop WEBCAT, a way for browsers and wallets to check that a website’s code matches what its developers published. It’s **not a trillion-dollar grant** —the name refers to the security initiative. 🔐
## Key Points
- 🛡 **WEBCAT checks website code integrity:** it verifies a site’s files against a developer-signed manifest and warns or blocks access if verification fails.
- ⚠ **HTTPS alone doesn’t prove the page is trustworthy:** it secures the connection, but can’t confirm the site’s code hasn’t been tampered with.
- 👛 **The grant supports wallet integration:** funding will go toward a verification library, Chromium-browser research, developer support, an independent security audit, and a proposed ERC standard.
- 📰 **The tool also supports secure journalism:** WEBCAT could help protect SecureDrop’s planned browser-side encryption from altered code that might capture messages before encryption.
- 🤝 **Adoption takes both sides:** wallet teams need to integrate the library, while app teams need to enroll their domains and publish signed manifests.
## In-depth summary
The article announces that the [Ethereum](https://talk.markets/t/ethereum-erc-20-cheatsheet/270?silent=true) Foundation’s **Trillion Dollar Security (1TS)** initiative is awarding a grant to the Freedom of the Press Foundation (FPF) for WEBCAT—short for _web-based code assurance and transparency_. The project addresses a blind spot in web security: HTTPS authenticates a connection and encrypts traffic, but it does not independently verify that the website code delivered to a visitor is the code its developers intended.
WEBCAT is designed to let browsers check a participating site’s resources against a signed manifest. An enrollment system publishes verifiable records of the site’s authorized signing identities and validation rules. The current alpha Firefox extension checks these records locally and blocks a page with a warning if verification fails. This matters for [Ethereum](https://talk.markets/t/ethereum-erc-20-cheatsheet/270?silent=true) apps because altered front-end code could, for example, change a transaction recipient or trick someone into signing something different from what the interface displays.
The grant will fund a verification library that wallets can incorporate, so users may get this protection without installing a separate extension. It will also support exploration of Chrome and other Chromium browsers, integrations with wallet and app teams, a security audit, and an ERC standard for wallet developers. The article notes that WEBCAT complements **Clear Signing** : Clear Signing helps users understand what they are approving, while WEBCAT aims to verify the integrity of the app’s front end.
## ELI5
A website can use a secure connection and still send your browser changed or malicious instructions. WEBCAT is like checking a website’s “official recipe” before your browser runs it. If the code doesn’t match, it can warn you or stop the page. 🍰
## Writers main point
Protecting users requires checking not only the connection to a website, but also whether the website’s code has been altered. The authors want wallets and app teams to adopt WEBCAT so browser-based [Ethereum](https://talk.markets/t/ethereum-erc-20-cheatsheet/270?silent=true) apps can be verified.
## Relevant links
- [Original article](https://blog.ethereum.org/2026/08/05/1ts-grant)
- [WEBCAT](https://webcat.tech/)
- [Freedom of the Press Foundation](https://freedom.press/)
- [SecureDrop](https://securedrop.org/)
- [Clear Signing announcement](https://blog.ethereum.org/2026/05/12/clear-signing-announcement)
- [Trillion Dollar Security](https://trilliondollarsecurity.org/)