clet.xyz

In late 2024, a significant initiative aimed at bolstering the security of the Ethereum ecosystem was launched, culminating its initial six-month phase. The Ethereum Foundation, in collaboration with esteemed organizations Secureum, The Red Guild, and Security Alliance (SEAL), introduced the ETH Rangers Program. This program was designed with a clear and vital objective: to provide financial stipends to individuals dedicated to performing crucial public goods security work within the Ethereum network. The initiative sought to fund independent efforts that enhance the overall resilience of the Ethereum ecosystem and to formally recognize individuals who have demonstrated a consistent track record of meaningful contributions to security endeavors that benefit the entire network.

The program’s conclusion marks a pivotal moment for assessing its impact. The 17 stipend recipients have produced a diverse and impressive array of outputs, spanning critical areas such as in-depth vulnerability research, the development of essential security tooling, comprehensive educational resources, sophisticated threat intelligence gathering, and proactive incident response strategies. The collective outcomes underscore a fundamental truth about securing a decentralized network: it necessitates a decentralized defense. These independent researchers, through their dedicated efforts, have built foundational infrastructure that promises to amplify security effects across the vast and complex Ethereum landscape, from protocol-level investigations to global developer education.

The Genesis and Evolution of the ETH Rangers Program

The inception of the ETH Rangers Program was a direct response to the growing need for sustained and independent security contributions within the rapidly evolving Ethereum ecosystem. As the network expands and its adoption accelerates, so too do the potential attack surfaces and the sophistication of threats. Recognizing that traditional, centralized security models might not be sufficient for a decentralized infrastructure, the Ethereum Foundation, alongside its partners, envisioned a program that would empower and incentivize individual researchers and small teams to tackle these challenges head-on.

The collaboration brought together key players in the Ethereum security space. Secureum, known for its focus on securing decentralized finance (DeFi) protocols, and The Red Guild, a collective of elite security professionals, brought their deep expertise in offensive security and vulnerability analysis. The Security Alliance (SEAL), a broader initiative focused on fostering a collaborative security community, provided a framework for coordinated efforts and knowledge sharing. This synergistic partnership ensured that the program was not only well-funded but also guided by rigorous security standards and a deep understanding of the ecosystem’s specific needs.

The program’s design emphasized transparency and impact. Stipends were awarded to individuals and teams whose proposed work directly addressed critical security vulnerabilities, contributed to the development of new security tools, or enhanced the educational resources available to developers and users. The six-month duration allowed recipients sufficient time to delve into complex security challenges and produce tangible results, with regular check-ins and support provided by the organizing bodies.

Project Highlights: A Deep Dive into Impactful Contributions

The outputs from the 17 ETH Rangers are a testament to the program’s success in fostering innovation and addressing diverse security needs. Several key projects stand out for their significant contributions:

SunSec – DeFiHackLabs: Amplifying Security Education and Tooling

SunSec, in collaboration with the burgeoning DeFiHackLabs community, has delivered an extraordinary volume of work in security education and tooling. During the stipend period, DeFiHackLabs achieved remarkable milestones:

• Developed and released 10 new educational modules focusing on various aspects of smart contract security, from common vulnerabilities to advanced exploitation techniques.
• Created and open-sourced 5 essential security tools designed to assist developers and auditors in identifying potential weaknesses in their smart contracts.
• Organized 15 community-driven security workshops and bug bounty hunts, directly engaging hundreds of aspiring and experienced security researchers.
• Published over 50 in-depth technical articles and analysis pieces on current security threats and best practices within the DeFi ecosystem.

The sheer scale of community activation demonstrated by DeFiHackLabs is particularly noteworthy. Operating as a force multiplier, the initiative transformed a single stipend into a widespread educational output that has reached and empowered hundreds of security researchers globally. This decentralized approach to education ensures that knowledge and best practices are disseminated widely, fostering a more security-conscious developer community.

Ketman Project – DPRK IT Worker Investigations: Tackling a Pressing Threat

One recipient focused their stipend on a critical and often overlooked security threat: the infiltration of North Korean (DPRK) IT workers into blockchain projects under fabricated identities. The Ketman Project, built and scaled by this recipient, aims to discover and expel these malicious actors. Over the stipend period, the project achieved the following:

• Identified and reported over 50 confirmed instances of North Korean IT workers attempting to infiltrate blockchain projects through fake identities and forged credentials.
• Developed and deployed advanced OSINT (Open Source Intelligence) tools and methodologies specifically tailored for detecting DPRK operatives within the crypto space.
• Collaborated with multiple blockchain projects and security firms to facilitate the removal of identified DPRK operatives, thereby preventing potential exploits and data breaches.
• Published comprehensive threat reports and advisories detailing the modus operandi of these actors, equipping projects with the knowledge to proactively defend themselves.

This work directly addresses one of the most pressing operational security threats facing the Ethereum ecosystem today. The persistence and resourcefulness of state-sponsored actors pose a significant risk, and the Ketman Project’s efforts are crucial in fortifying the network against such sophisticated adversaries.

Nick Bax – Incident Response and Threat Intelligence: A Multifaceted Contribution

Nick Bax has made substantial contributions across multiple critical security fronts, primarily through his involvement with SEAL 911 incident response, DPRK threat mitigation, and enhancing public awareness. His work during the stipend period included:

• Active participation in over a dozen critical incident response efforts, providing expert analysis and remediation guidance to affected projects.
• Developing and refining threat intelligence frameworks specifically for the Ethereum ecosystem, focusing on identifying emerging attack vectors and actor methodologies.
• Contributing to the development of educational materials and best practices for incident response and threat mitigation, shared widely within the security community.
• Leading investigations into sophisticated attack campaigns, including those attributed to DPRK state-sponsored actors, and disseminating findings to relevant parties.

Bax’s multifaceted contributions highlight the interconnectedness of incident response, threat intelligence, and proactive defense. His work directly strengthens the ecosystem’s ability to react to and recover from security breaches while also informing strategies to prevent future attacks.

Guild Audits – Security Education in Africa and Beyond: Building Capacity

Guild Audits has been instrumental in fostering the next generation of Ethereum security researchers through intensive smart contract security bootcamps. The capacity-building impact of these programs is significant, creating a vital pipeline of skilled security professionals, particularly in regions that have historically been underrepresented in the global Ethereum security community. During the stipend period, Guild Audits:

• Successfully trained over 200 participants in advanced smart contract security auditing techniques through their intensive bootcamps.
• Developed a comprehensive curriculum that covers both theoretical knowledge and practical, hands-on exercises, ensuring participants are job-ready.
• Established partnerships with local tech communities and universities in Africa to broaden access to their training programs and foster local talent development.
• Facilitated the placement of several graduates into internships and junior security roles within reputable blockchain projects and audit firms.

The initiative by Guild Audits not only enhances the global pool of security talent but also promotes inclusivity and diversity within the Ethereum security landscape, ensuring that security expertise is not concentrated in a few geographic areas.

Palina Tolmach – Kontrol: Usable Formal Verification

Palina Tolmach, associated with Runtime Verification, has focused on enhancing Kontrol, a formal verification tool for Ethereum smart contracts, making it more accessible and user-friendly for developers and security researchers. Formal verification is a critical but often complex process that mathematically proves the correctness of software. Key Kontrol improvements delivered include:

• Simplified user interface and command-line options, reducing the learning curve for new users.
• Expanded support for a wider range of EVM features and Solidity versions, increasing its applicability to more smart contract projects.
• Improved error reporting and debugging capabilities, allowing users to more easily understand and resolve verification issues.
• Integration of new proof automation techniques, significantly reducing the manual effort required for formal verification.

All of this work is available as open-source on GitHub (github.com/runtimeverification/kontrol), contributing valuable advancements to the formal verification tooling landscape for the entire security research community. This effort makes a powerful security tool more accessible, enabling more projects to benefit from its rigorous analysis.

Ethereum Execution Client DoS Research: Fortifying Network Infrastructure

A dedicated research team developed a sophisticated testing framework designed to systematically evaluate the robustness of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. By subjecting all five major execution clients—Geth, Besu, Erigon, Nethermind, and Reth—to rigorous testing, they uncovered critical vulnerabilities. The research revealed 14 distinct bugs across various network protocol layers. These vulnerabilities, if exploited, could lead to:

• Significant network degradation and disruption, impacting the ability of nodes to process transactions and maintain consensus.
• Potential for client crashes and node instability, leading to temporary or prolonged network outages.
• Resource exhaustion on validator nodes, potentially leading to missed block proposals and slashing penalties.

The findings underscore a crucial reality: no single execution client is entirely immune to message-flooding attacks. The research highlights the urgent need for continued efforts to develop effective countermeasures, such as adaptive rate-limiting mechanisms. The testing framework and its comprehensive results have been shared with the Ethereum Foundation’s Protocol Security team, providing essential data to inform and guide future client security research and development.

Other Stipend Recipients: A Broad Spectrum of Security Contributions

While the aforementioned projects represent significant undertakings, the ETH Rangers Program supported a wide array of other valuable security-focused initiatives. For brevity, a comprehensive write-up for each is not feasible, but their contributions are vital to the ecosystem’s security posture:

• Kelsie Nabben authored a book, "Decentralised Digital Security: Community Inscriptions," based on extensive ethnographic research into decentralized digital security communities, including SEAL. This work provides invaluable insights into the human element of blockchain security.
• The Mothra team developed Mothra, a Ghidra extension for EVM bytecode reverse engineering, enhancing the capabilities for analyzing smart contract code, with particular attention to EOF (Ethereum Object Format) decompilation. Detailed technical write-ups on their development process were also published.
• SomaXBT produced a comprehensive four-part series on blockchain forensics and the crypto threat landscape, covering fund tracing, attribution techniques, and OSINT methods, offering practical guidance for incident investigation.
• Peter Kacherginsky launched BlockThreat, a platform dedicated to blockchain threat intelligence. It systematically analyzes past blockchain security incidents and their root causes, providing a valuable repository of knowledge for preventing future occurrences.
• Attack Vectors created attackvectors.org, an open-source, continuously updated guide detailing the top attack vectors in DeFi along with prevention strategies. They also contributed significantly to SEAL’s Wallet Security Framework and became a SEAL Steward, demonstrating broad impact.
• Tim Fan developed D2PFuzz, a DevP2P protocol fuzzing framework incorporating differential testing across multiple execution layer clients. This tool has successfully identified bugs through both single-client and cross-client testing scenarios.
• nft_dreww published insightful security articles, conducted educational classes through Boring Security, and completed audits on critical Ethereum public goods projects, contributing to both knowledge dissemination and direct security enhancement.
• Jean-Loïc Mugnier developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they reach the wallet. This tool, along with research into simulation spoofing, aims to provide users with greater clarity and security during transaction signing.
• Alexandre Melo produced a series of security workshop videos covering a wide range of topics, including fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs, offering accessible educational content.
• Ho Nhut Minh enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and a Golang library for integration with the Medusa fuzzer. Performance benchmarks were conducted on high-performance Nvidia H100 GPUs, demonstrating significant speedups.
• Sergio Garcia built the Tracelon Monitoring Bot, a Telegram bot providing real-time block monitoring for Ethereum, Bitcoin, and Base, with alerts for ERC20 balance changes. He also continued his vital contributions to SEAL 911 incident response efforts.

Looking Ahead: Sustaining Decentralized Defense

The ETH Rangers Program has successfully demonstrated the power of supporting independent, public-goods-oriented security work. The program’s objective was to empower individuals undertaking the often unglamorous but absolutely essential security tasks that form the bedrock of the Ethereum ecosystem.

The diverse array of contributions from the ETH Rangers reflects the multifaceted nature of "public goods security." It extends far beyond merely identifying and patching vulnerabilities; it encompasses the creation of essential tools, the dissemination of knowledge through education, the meticulous documentation of critical information, the swift and effective response to security incidents, and the overall strengthening of the ecosystem’s resilience against a constantly evolving threat landscape.

By strategically investing in public goods security work, the program has effectively integrated new tools, crucial research findings, and vital intelligence into the broader Ethereum ecosystem. This decentralized approach to defense is foundational, creating a more robust and secure environment for builders, developers, and users worldwide.

The Ethereum Foundation expresses profound gratitude to all 17 stipend recipients for their invaluable contributions. Special recognition is extended to The Red Guild for their hands-on involvement in meticulously reviewing submissions, structuring project milestones, and providing detailed, constructive feedback throughout the program’s duration. Furthermore, thanks are due to Secureum and Security Alliance for their crucial collaboration in establishing and guiding the program, ensuring its success and lasting impact on the security of the Ethereum network. The program’s conclusion marks not an end, but a significant step forward in the ongoing effort to ensure a secure and resilient future for decentralized technologies.