The Ethereum Foundation’s Trillion Dollar Security, or 1TS, initiative said it is giving a dedicated grant to the Freedom of the Press Foundation to support continued development of WEBCAT, an open-source tool aimed at fixing a long-standing front-end code verification gap affecting Ethereum wallets and decentralized applications, or dApps.
WEBCAT, short for Web-based Code Assurance and Transparency, is built to help browsers check whether the code loaded by a website matches the version publicly released by its developers.
Grant targets Ethereum wallet and application use cases
According to the Ethereum Foundation, the funding will help expand WEBCAT into Ethereum wallet and application scenarios so users can verify whether the front-end page they are visiting has been tampered with.
The foundation said HTTPS can verify the website a user connects to and encrypt communications, but it cannot prove that the front-end code actually running on the site is the version published by the developer.
Foundation outlines the risks of compromised front ends
The Ethereum Foundation said that if an attacker gains control of a site’s front-end code, the attacker may be able to change a transaction recipient address without the user’s knowledge or prompt the user to sign a transaction that does not match what is shown on the page.
It added that front-end attacks have become an important security risk for blockchain infrastructure. Malicious changes to a web interface can lead to supply-chain attacks, follow-on attacks after DNS hijacking, and deceptive user interface behavior.
WEBCAT to work alongside Clear Signing under 1TS
WEBCAT was originally developed by the Freedom of the Press Foundation to improve code trustworthiness for secure communication systems including SecureDrop.
With the expansion into the Ethereum ecosystem, the tool is expected to complement security measures under the 1TS program, including Clear Signing. The first helps wallets confirm that an application front end has not been altered. The second helps users understand the transaction content they are approving.