以太坊基金会向WEBCAT提供安全资助，助力钱包验证前端代码防范钓鱼攻击

The Ethereum Foundation's "Trillion Dollar Security" (1TS) initiative has announced a dedicated grant to the Freedom of the Press Foundation (FPF), supporting the continued development of the open-source tool WEBCAT to address the long-standing security gap in front-end code verification for Ethereum wallets and decentralized applications (DApps).

WEBCAT (Web-based Code Assurance and Transparency) is an open-source tool designed to help browsers verify whether the code loaded by a website matches the version publicly released by its developers. This grant will drive WEBCAT's expansion into Ethereum wallet and application use cases, enabling users to verify whether the front-end pages they visit have been tampered with.

The Ethereum Foundation noted that while HTTPS can verify the website a user is connecting to and encrypt communications, it cannot prove that the front-end code actually running on the site is the version released by the developers. If an attacker compromises a website's front-end code, they could modify transaction recipient addresses without the user's knowledge, or trick users into signing transactions that differ from what is displayed on the page.

The Ethereum Foundation stated that front-end attacks have become a major security risk for blockchain infrastructure. Maliciously altered web interfaces can lead to supply chain attacks, post-DNS-hijacking exploits, and user interface spoofing.

WEBCAT was originally developed by the Freedom of the Press Foundation to enhance code trustworthiness for secure communication systems such as SecureDrop. With this expansion into the Ethereum ecosystem, it will complement other 1TS security measures like "Clear Signing": the former helps wallets confirm that the application front-end has not been tampered with, while the latter helps users understand the content of the transactions they are approving.