A compromised website can drain a wallet without ever touching the private key.
The wallet trusts the code the website serves but has no way to check if that code has been altered. A tampered frontend can swap addresses or change what a transaction signs before the wallet sees it.
The @ethereumfndn's Trillion Dollar Security grant initiative is backing WEBCAT to solve this.
WEBCAT checks whether the code a website serves matches what developers actually published. If anything has been changed, the page is blocked before it loads.
> Wallets can integrate it directly without users installing anything extra
> Chrome support being researched alongside the existing Firefox version
> App teams can register their domains and publish signed code
> Independent security audit funded
ERC standard so all wallet teams build it the same way
WEBCAT works alongside Clear Signing.
WEBCAT makes sure the app requesting approval has not been altered in the first place.
Front-end attacks are an infrastructure-level risk and the Ethereum Foundation is backing WEBCAT to solve this.