clet.xyz

In late 2024, a significant collaborative effort was launched to bolster the security infrastructure of the Ethereum ecosystem. The Ethereum Foundation, in partnership with leading security organizations Secureum, The Red Guild, and the Security Alliance (SEAL), introduced the ETH Rangers Program. This pioneering initiative was designed to provide crucial financial stipends to individuals dedicated to performing essential public goods security work within Ethereum. The program’s objective was clear and ambitious: to fund independent security research and development that would enhance the overall resilience of the Ethereum network and to formally recognize individuals who had already demonstrated a significant track record of valuable contributions to the ecosystem’s security.

The six-month ETH Rangers Program has recently concluded, and its outcomes offer a compelling testament to the power of decentralized security efforts. The 17 stipend recipients have produced a remarkably diverse array of work, spanning critical areas such as in-depth vulnerability research, the development of essential security tooling, comprehensive educational resources, advanced threat intelligence, and effective incident response strategies. These collective achievements underscore a fundamental truth in securing a decentralized network: a robust defense must itself be decentralized, relying on a distributed network of skilled individuals and collaborative efforts. The independent researchers supported by this program have effectively built infrastructure and disseminated knowledge that will multiply security benefits across the entire Ethereum ecosystem, from the deepest protocol layers to global developer communities.

Background and Genesis of the ETH Rangers Program

The proliferation of decentralized applications (dApps) and the increasing value locked within the Ethereum ecosystem have made it a prime target for malicious actors. Recognizing the inherent complexities and the vital importance of maintaining a secure network, the Ethereum Foundation, alongside key security collaborators, identified a critical need to proactively support and incentivize independent security professionals. The ETH Rangers Program was conceived as a direct response to this need, aiming to bridge the gap between the growing security challenges and the available resources for independent researchers.

The program’s design prioritized funding individuals and small teams who could operate with autonomy, focusing on areas where traditional corporate funding might be less accessible or less agile. The emphasis on "public goods" meant that the outputs of the program were intended to be open-source, freely available, and directly beneficial to the broader Ethereum community, rather than proprietary solutions. The collaboration with Secureum, The Red Guild, and SEAL brought together organizations with deep expertise in different facets of blockchain security, ensuring a comprehensive approach to identifying, evaluating, and supporting promising security initiatives.

Timeline of the Program

• Late 2024: The ETH Rangers Program is officially launched by the Ethereum Foundation, Secureum, The Red Guild, and SEAL. Applications open for individuals and teams engaged in public goods security work.
• Early 2025: The selection process is completed, and the 17 stipend recipients are announced. Stipends are disbursed, allowing recipients to dedicate focused time and resources to their projects.
• Mid-2025: Recipients actively engage in their research, development, and educational activities, with ongoing mentorship and support from the organizing bodies.
• Late 2025: The six-month program period concludes. Recipients submit their final reports and deliverables, showcasing the outcomes of their work.
• Present: The Ethereum Foundation, in collaboration with its partners, publishes the results of the ETH Rangers Program, highlighting the significant contributions made by the stipend recipients.

Consolidated Outcomes and Impact

The aggregated impact of the ETH Rangers Program is a testament to the strategic allocation of resources towards critical security needs. While the specific outputs are detailed below, the overarching themes reveal a proactive and multifaceted approach to securing Ethereum. The program has demonstrably fostered innovation in vulnerability discovery, enhanced the development of practical security tools, expanded the reach of security education, improved threat intelligence capabilities, and strengthened incident response mechanisms. This distributed defense model is proving to be a highly effective strategy for fortifying the ecosystem against evolving threats.

Project Highlights and Key Contributions

The program yielded a wealth of impactful projects, each addressing distinct but vital aspects of Ethereum security.

SunSec – DeFiHackLabs

SunSec, in collaboration with the DeFiHackLabs community, delivered an exceptional volume of security education and tooling. During the stipend period, DeFiHackLabs accomplished several key milestones:

• Development of educational modules: Created comprehensive learning materials covering smart contract security best practices, common vulnerabilities, and secure coding techniques.
• Release of security tools: Developed and open-sourced tools designed to assist developers in identifying and mitigating security risks in their smart contracts.
• Community workshops and webinars: Organized and hosted numerous online events to disseminate knowledge and foster a culture of security awareness among developers.
• Vulnerability disclosure and remediation: Actively participated in identifying and reporting vulnerabilities in various DeFi protocols, contributing to their secure operation.

The sheer scale of community activation achieved by DeFiHackLabs is particularly noteworthy. By operating as a multiplier, the initiative transformed a single stipend into educational output that reached hundreds of security researchers, significantly expanding the pool of skilled professionals capable of securing the DeFi landscape.

Ketman Project – DPRK IT Worker Investigations

One recipient dedicated their stipend to significantly scaling the Ketman Project, an initiative focused on identifying and neutralizing the presence of North Korean (DPRK) IT workers who have been covertly infiltrating blockchain projects under deceptive identities. This is a critical operational security threat that poses risks ranging from intellectual property theft to the potential for network manipulation.

Over the stipend period, the Ketman Project achieved the following:

• Enhanced detection methodologies: Developed and refined sophisticated methods for identifying suspicious activity patterns indicative of DPRK state-sponsored actors.
• Information sharing and collaboration: Established crucial communication channels and data-sharing agreements with other security organizations and law enforcement agencies to coordinate efforts.
• Public awareness campaigns: Launched initiatives to educate the broader blockchain community about the threat posed by these infiltrators and how to recognize potential signs.
• Contribution to incident response: Provided critical intelligence and support to organizations affected by suspected DPRK involvement.

This work directly addresses one of the most pressing and insidious operational security threats currently facing the Ethereum ecosystem, demonstrating the program’s commitment to tackling high-impact security challenges.

Nick Bax – Incident Response and Threat Intelligence

Nick Bax made significant contributions across multiple fronts, primarily through his involvement with SEAL 911 incident response, efforts to mitigate DPRK-related threats, and public awareness initiatives. His work exemplifies the multifaceted nature of modern cybersecurity.

Key contributions from Nick Bax include:

• Active participation in incident response: Played a vital role in SEAL 911, providing timely and expert assistance during security incidents affecting the Ethereum ecosystem. This involved rapid analysis, containment, and remediation strategies.
• Threat intelligence analysis: Contributed to the understanding and mitigation of threats posed by North Korean IT workers, leveraging his expertise to identify and track their activities.
• Development of security resources: Created and disseminated valuable resources, such as threat advisories and best practice guides, to enhance the security posture of developers and users.
• Public education and advocacy: Engaged in public discourse and educational efforts to raise awareness about critical security issues within the blockchain space.

Guild Audits – Security Education in Africa and Beyond

Guild Audits spearheaded intensive smart contract security bootcamps, a vital effort aimed at training the next generation of Ethereum security researchers. This initiative is crucial for building capacity in regions that have historically been underrepresented in the cybersecurity field.

The impact of Guild Audits’ bootcamps includes:

• Curriculum development: Designed and delivered a robust curriculum covering theoretical concepts and practical applications of smart contract security auditing.
• Participant training: Empowered a significant number of individuals with the skills and knowledge necessary to perform security audits and contribute to the ecosystem’s safety.
• Regional outreach: Focused on underserved regions, creating opportunities for individuals to enter the burgeoning blockchain security sector.
• Alumni network building: Fostered a community among bootcamp graduates, encouraging continued learning, collaboration, and knowledge sharing.

The capacity-building impact of Guild Audits’ smart contract security bootcamps is substantial, creating a pipeline of skilled security researchers in regions that have historically lacked adequate representation in the Ethereum security community. This expansion of the global security talent pool is a long-term strategic advantage for Ethereum.

Palina Tolmach – Kontrol: Usable Formal Verification

Palina Tolmach, affiliated with Runtime Verification, focused on enhancing Kontrol, a sophisticated formal verification tool for Ethereum smart contracts. The goal was to make this powerful tool more accessible and user-friendly for a broader audience of developers and security researchers.

Key improvements to Kontrol delivered during the stipend period include:

• Improved user interface and experience: Streamlined the process of using Kontrol, reducing the technical barrier to entry for formal verification.
• Expanded language support: Enhanced Kontrol’s ability to analyze a wider range of smart contract languages and constructs.
• Integration with development workflows: Facilitated smoother integration of Kontrol into existing smart contract development pipelines.
• Comprehensive documentation and tutorials: Created detailed guides and learning materials to assist users in effectively leveraging the tool’s capabilities.

All of this work is available as open-source on GitHub, significantly improving the formal verification tooling landscape for all security researchers and developers. Formal verification is a critical, albeit complex, method for ensuring the correctness and security of smart contracts, and making such tools more accessible is paramount for widespread adoption.

Ethereum Execution Client DoS Research

A dedicated research team developed a sophisticated testing framework to systematically evaluate the robustness of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. This is a crucial area of research as the stability of execution clients is fundamental to the network’s overall health.

Through their rigorous testing of all five major execution clients (Geth, Besu, Erigon, Nethermind, and Reth), the team discovered:

• 14 critical bugs: Identified a significant number of vulnerabilities across various network protocol layers within the execution clients.
• Potential for network disruption: These bugs can lead to various negative consequences, including:
  • Node crashes: Causing individual nodes to become unresponsive and offline.
  • Network forks: Leading to temporary inconsistencies in the blockchain’s state.
  • Resource exhaustion: Consuming excessive CPU, memory, or network bandwidth, impacting node performance and stability.

The findings emphatically highlight that no single execution client is immune to message-flooding attacks. This research underscores the urgent need for continued efforts to develop effective countermeasures, such as adaptive rate-limiting mechanisms and more resilient protocol designs. The testing framework and the detailed results have been shared with the Ethereum Foundation’s Protocol Security team, providing invaluable insights to inform further client security research and development.

Other Stipend Recipients and Their Diverse Contributions

While the program aims to highlight specific projects, the breadth of contributions from all 17 recipients is extensive. For brevity, a full write-up for every project is not feasible here, but their work collectively spans a wide range of crucial security-related public goods:

• Kelsie Nabben: Authored a book based on extensive ethnographic research into decentralized digital security communities, including SEAL, offering deep insights into the human element of blockchain security.
• Mothra team: Developed Mothra, a Ghidra extension for EVM bytecode reverse engineering, significantly aiding in the analysis of smart contracts. They also published detailed technical documentation of their development process.
• SomaXBT: Published a comprehensive four-part series on blockchain forensics, detailing fund tracing, attribution techniques, and OSINT methods crucial for investigating on-chain illicit activities.
• Peter Kacherginsky: Launched BlockThreat, a platform dedicated to blockchain threat intelligence, analyzing past security incidents to identify root causes and inform future prevention strategies.
• Attack Vectors: Created attackvectors.org, an open-source, continuously updated guide detailing common DeFi attack vectors and their prevention strategies. They also contributed to SEAL’s Wallet Security Framework and became a SEAL Steward.
• Tim Fan: Developed D2PFuzz, a DevP2P protocol fuzzing framework, which utilizes differential testing across multiple execution layer clients to uncover bugs.
• nft_dreww: Contributed through security articles, educational classes via Boring Security, and completed audits on Ethereum public goods projects, actively enhancing the ecosystem’s security posture.
• Jean-Loïc Mugnier: Developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they reach the wallet, alongside research into simulation spoofing.
• Alexandre Melo: Produced a series of security workshop videos covering topics such as fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs, disseminating valuable knowledge.
• Ho Nhut Minh: Enhanced CuEVM, a GPU-accelerated EVM implementation, with multi-GPU support and a Golang library for integration with the Medusa fuzzer, benchmarking performance on high-end GPUs.
• Sergio Garcia: Built the Tracelon Monitoring Bot, a Telegram bot providing real-time block monitoring for Ethereum, Bitcoin, and Base, with alerts for ERC20 balance changes. He also continued to contribute to SEAL 911 incident response.

Looking Ahead: The Future of Decentralized Security Defense

The ETH Rangers Program has effectively demonstrated its core mission: to support individuals engaged in the often unglamorous but absolutely essential security work that underpins the Ethereum ecosystem. The sheer variety of contributions from the stipend recipients highlights the expansive definition of "public goods security." It extends far beyond mere bug discovery to encompass the crucial activities of building innovative tools, training new generations of security professionals, meticulously documenting knowledge, responding adeptly to incidents, and, in doing so, making the entire ecosystem more resilient and trustworthy.

By actively supporting these public goods security initiatives, the program has successfully integrated new tools, groundbreaking research, and vital intelligence into the broader Ethereum ecosystem. This decentralized approach to defense creates a stronger, more robust foundation for builders, developers, and users worldwide, fostering an environment of greater trust and security.

The Ethereum Foundation, along with its partners Secureum, The Red Guild, and SEAL, expressed profound gratitude to all 17 stipend recipients for their invaluable contributions. Special recognition was given to The Red Guild for their hands-on involvement in reviewing submissions, structuring project milestones, and providing detailed, constructive feedback throughout the program’s duration. The collaborative spirit and shared commitment to enhancing Ethereum’s security have laid a strong groundwork for future initiatives. The success of the ETH Rangers Program serves as a powerful model for how decentralized communities can effectively mobilize resources to address critical security challenges, ensuring a more secure and sustainable future for blockchain technology.