Announcing a Trillion Dollar Security grant for WEBCAT
The Ethereum Foundation’s Trillion Dollar Security (1TS) initiative is proud to announce a grant allocation to Freedom of the Press Foundation (FPF) to support the continued development of WEBCAT. WEBCAT is an open source tool that lets browsers verify that code served by an enrolled website matches what its developers...
This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.
The headline figure in a security grant announcement is the least informative part of it. A trillion-dollar pool sounds like an enormous commitment; in practice these funds are usually denominated in a token whose value fluctuates, allocated over many years, and intended to cover a category of work rather than a single bounty. Here is how to read one properly.
What a grant programme of this size actually is
A ceiling, not a payment. The number is the maximum the programme could ever distribute if every approved project drew the full amount. Real disbursement over the programme’s life will be a fraction of it.
Denominated in a volatile asset. If the pool is expressed in tokens rather than USD, the dollar value moves daily. Any comparison to a “nine-figure” budget requires knowing which token and which date.
Spread over years and across many recipients. The per-recipient figure is the one that matters to an independent researcher, and it is usually much smaller than the headline.
What to check before treating it as news
The administering entity. Who holds the funds, and under what mandate? A programme administered by a foundation is different from one administered by a company, and different again from a single person’s commitment.
Whether prior programmes paid out. The most useful signal about a new multi-year programme is whether a similar previous one actually disbursed. Announcements of programmes are cheap; payout records are not.
The eligibility rules. Whether individuals can apply, whether applications are reviewed, and what the acceptance bar is. A grant only open to employees of an affiliated company is not a grant programme in the sense most readers assume.
Whether the token is liquid and where it trades. An illiquid token cannot be spent like cash, which changes the practical value considerably.
What a large grant programme does and does not change
Security work responds slowly. A funded programme produces better tooling, published audits, and a larger pool of people who understand a codebase — over years, not weeks. Treating an announcement as an immediate reduction in risk is a category error; the observable effect on exploited protocols will not show up in any timeframe that matters to a current position.
The one legitimate near-term signal is attention: more researchers looking at a category means more findings reported, including in code that was previously ignored. That is a benefit, and it is not the same as the protocol becoming safe.
What this does not establish
Nothing in a grant announcement tells you whether the specific protocols you hold are sound, whether past exploits have been fully remediated, or whether the awarding body will continue funding the programme after the announced period. Treat the figure as evidence of intent and of available budget, and nothing more precise.