In late 2024, a pivotal initiative aimed at bolstering the security of the Ethereum ecosystem reached a significant milestone. The Ethereum Foundation, in collaboration with prominent security organizations Secureum, The Red Guild, and the Security Alliance (SEAL), successfully concluded the six-month ETH Rangers Program. This ambitious undertaking was designed to provide crucial financial stipends to individuals dedicated to public goods security work within the decentralized landscape of Ethereum. The program’s core objective was to foster and fund independent efforts that enhance the overall resilience of the Ethereum network, while simultaneously recognizing and empowering individuals with a proven track record of making meaningful contributions to security that benefits the entire ecosystem.
The conclusion of this inaugural six-month cycle marks a moment to reflect on the substantial output generated by the 17 stipend recipients. Their collective work spans an impressive array of critical security domains, including in-depth vulnerability research, the development of essential security tooling, comprehensive educational initiatives, sophisticated threat intelligence gathering, and rapid incident response capabilities. This broad spectrum of contributions underscores the multifaceted nature of securing a decentralized network, demonstrating that a robust defense is inherently a decentralized one. The independent researchers supported by the ETH Rangers Program have been instrumental in building infrastructure and knowledge that promises to multiply security effects across the entire Ethereum network, from the deepest protocol layers to global developer education.
Genesis of the ETH Rangers Program: A Response to Evolving Threats
The launch of the ETH Rangers Program in late 2024 was not an isolated event but a strategic response to the escalating complexity and sophistication of security threats targeting decentralized networks like Ethereum. As the ecosystem has grown, so too have the potential attack surfaces and the ingenuity of malicious actors. Recognizing that maintaining the integrity and security of such a vast and distributed system requires a coordinated yet decentralized approach to defense, the Ethereum Foundation, alongside its esteemed partners, conceived of a program that could directly support the often-underfunded but vital work of independent security researchers.
The collaboration with Secureum, The Red Guild, and Security Alliance (SEAL) brought together organizations with deep expertise in different facets of blockchain security. Secureum, known for its rigorous training and research in security auditing, provided a strong foundation for identifying and nurturing talent. The Red Guild, a collective of elite security professionals, played a crucial role in the program’s operational execution, including the rigorous review of submissions and the structuring of project milestones. SEAL, a broader alliance focused on establishing industry-wide security standards and best practices, offered a framework for the long-term impact and integration of the research produced. This synergistic partnership was instrumental in ensuring the program’s objectives were met effectively and that the supported work aligned with the overarching security needs of the Ethereum ecosystem.
Project Highlights: A Deep Dive into Impactful Contributions
The diversity of the ETH Rangers’ achievements is a testament to the program’s success in identifying and supporting critical security work. Several key projects stand out for their significant contributions:
SunSec – DeFiHackLabs: Amplifying Security Education
The collaboration between SunSec and the DeFiHackLabs community has resulted in an extraordinary output of security education and tooling. Throughout the stipend period, the DeFiHackLabs initiative, spearheaded by SunSec, achieved remarkable milestones. This included the development and dissemination of over 30 comprehensive security tutorials covering smart contract auditing, common vulnerabilities, and best practices for secure development. Furthermore, they facilitated more than 10 hands-on workshops and hackathons, directly engaging hundreds of aspiring and established security researchers. The community also contributed to the creation of 5 new open-source security tools, designed to aid developers in identifying and mitigating potential risks in their smart contracts.
The sheer scale of community activation demonstrated by DeFiHackLabs is particularly noteworthy. Operating as a powerful multiplier, the project transformed a single stipend into a vast educational output that has reached and empowered hundreds of security researchers. This approach not only disseminates vital security knowledge but also fosters a more engaged and skilled community, essential for the long-term health of the Ethereum ecosystem. The impact of this initiative extends beyond mere knowledge transfer; it cultivates a culture of proactive security awareness and skill development, crucial for a rapidly evolving technological landscape.
Ketman Project – DPRK IT Worker Investigations: Addressing a Critical Threat
One recipient channeled their stipend into significantly scaling the Ketman Project, an initiative dedicated to identifying and expelling North Korean (DPRK) IT workers who have been discovered infiltrating blockchain projects under false identities. This work directly confronts one of the most pressing operational security threats currently facing the Ethereum ecosystem. During the stipend period, the Ketman Project achieved several key objectives. They successfully identified and reported over 50 suspected DPRK IT workers across various blockchain platforms, leading to the termination of their engagement with multiple projects. Furthermore, they developed and disseminated detailed threat intelligence reports to relevant industry stakeholders and law enforcement agencies, providing actionable insights into the tactics, techniques, and procedures employed by these actors. The project also created a secure reporting channel and a knowledge base to assist other organizations in detecting and responding to similar infiltration attempts.
This critical work highlights the necessity of addressing state-sponsored or organized malicious activity within the decentralized space. By exposing and disrupting these operations, the Ketman Project not only safeguards individual projects but also contributes to the overall integrity and trustworthiness of the Ethereum network, assuring users and developers of a more secure environment. The proactive nature of this investigation is a crucial component of a robust decentralized defense strategy.
Nick Bax – Incident Response and Threat Intelligence: A Multifaceted Contribution
Nick Bax, an active contributor within the security community, made significant contributions across multiple fronts, primarily through his involvement with SEAL 911 incident response, DPRK threat mitigation, and public awareness initiatives. His work involved providing critical real-time support during several high-profile security incidents, helping to coordinate response efforts and minimize potential damage. In parallel, he actively participated in threat intelligence gathering and analysis related to DPRK actors, contributing to the ongoing efforts to understand and counter their activities within the blockchain space. Bax also focused on raising public awareness through educational content and presentations, highlighting emerging threats and best practices for users and developers. His contributions also extended to the development of improved incident response playbooks and frameworks, enhancing the collective ability of the ecosystem to handle future security challenges.
Guild Audits – Security Education in Africa and Beyond: Building Future Talent
Guild Audits has taken on the vital task of capacity building through intensive smart contract security bootcamps, aiming to train the next generation of Ethereum security researchers. These bootcamps are designed to provide a comprehensive curriculum, covering everything from fundamental smart contract development to advanced auditing techniques, formal verification, and exploit analysis. The program has shown remarkable success in graduating a significant number of participants who have gone on to contribute to the security of various blockchain projects. Notably, Guild Audits has focused on reaching regions that have historically been underrepresented in the global Ethereum security community, thereby fostering greater diversity and inclusivity within the field. The organization has also developed a framework for ongoing mentorship and community support for its graduates, ensuring a continuous pipeline of skilled security professionals.
The capacity-building impact of Guild Audits’ smart contract security bootcamps is substantial. By creating a pathway for individuals in historically underserved regions to enter the field of blockchain security, they are not only strengthening the Ethereum ecosystem but also promoting economic opportunity and technological empowerment on a global scale. This initiative underscores the importance of education as a cornerstone of decentralized security.
Palina Tolmach – Kontrol: Usable Formal Verification: Enhancing Tooling
Palina Tolmach, affiliated with Runtime Verification, has dedicated her stipend to improving Kontrol, a formal verification tool specifically designed for Ethereum smart contracts. Her work has focused on making this powerful tool more accessible and user-friendly for a broader audience of developers and security researchers. Key Kontrol improvements delivered include the enhancement of its user interface to simplify the process of defining verification properties and interpreting results. She has also expanded the tool’s support for a wider range of smart contract patterns and languages, increasing its applicability. Furthermore, Tolmach has worked on integrating Kontrol with popular development environments and CI/CD pipelines, enabling seamless incorporation into existing development workflows. The entirety of this work is open-source, hosted on GitHub, and available for all security researchers to leverage, thereby advancing the formal verification tooling landscape for the entire ecosystem.
Ethereum Execution Client DoS Research: Identifying Network Vulnerabilities
A dedicated research team has developed a sophisticated testing framework to systematically evaluate the robustness of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. This critical research involved testing all five major execution clients: Geth, Besu, Erigon, Nethermind, and Reth. The rigorous testing uncovered a significant number of vulnerabilities, with the team identifying a total of 14 bugs across different network protocol layers. These vulnerabilities have the potential to lead to severe consequences, including network instability, increased transaction latency, and, in some cases, complete node crashes.
The findings from this research underscore a critical reality: no single execution client is entirely immune to message-flooding attacks. This highlights the urgent need for continued development of effective countermeasures, such as adaptive rate-limiting mechanisms, to fortify the network. The research team has proactively shared their testing framework and detailed findings with the Ethereum Foundation’s Protocol Security team. This collaboration is expected to inform further client security research and development, paving the way for more resilient and secure execution clients in the future.
Other Stipend Recipients: A Broad Spectrum of Security Contributions
While not all projects could be detailed individually, the remaining stipend recipients have also made invaluable contributions to Ethereum’s public goods security. Their work spans a wide array of crucial areas:
- Kelsie Nabben: Authored a significant book based on extensive ethnographic research into decentralized digital security communities, including SEAL. This work offers deep insights into the human element of blockchain security.
- Mothra team: Developed Mothra, a Ghidra extension designed for EVM bytecode reverse engineering, incorporating support for EOF decompilation. They also published detailed technical documentation on their development process.
- SomaXBT: Published a comprehensive four-part series on blockchain forensics and the crypto threat landscape, delving into fund tracing, attribution techniques, and OSINT methodologies.
- Peter Kacherginsky: Launched BlockThreat, a platform dedicated to blockchain threat intelligence, which analyzes past security incidents and their root causes.
- Attack Vectors: Created attackvectors.org, an open-source, continuously updated guide detailing prevalent DeFi attack vectors and offering prevention strategies. They also contributed to SEAL’s Wallet Security Framework and became a SEAL Steward.
- Tim Fan: Developed D2PFuzz, a DevP2P protocol fuzzing framework that employs differential testing across multiple execution layer clients, successfully uncovering bugs through both single-client and cross-client analysis.
- nft_dreww: Contributed through security articles, educational classes via Boring Security, and completed audits on Ethereum public goods projects, actively engaging with the community.
- Jean-Loïc Mugnier: Developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they reach the wallet, alongside research into simulation spoofing.
- Alexandre Melo: Produced a series of security workshop videos covering diverse topics such as fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs.
- Ho Nhut Minh: Enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and a Golang library for integration with the Medusa fuzzer, with benchmarks conducted on high-performance Nvidia H100 GPUs.
- Sergio Garcia: Built the Tracelon Monitoring Bot, a Telegram bot providing real-time block monitoring for Ethereum, Bitcoin, and Base, with alerts for ERC20 balance changes. He also continued to contribute to SEAL 911 incident response.
Looking Ahead: Sustaining Decentralized Defense
The ETH Rangers Program has successfully demonstrated its foundational principle: supporting individuals engaged in the often-unseen but critically important security work that underpins the Ethereum ecosystem. The diverse nature of the contributions made by the stipend recipients vividly illustrates the expansive definition of "public goods security" in practice. It encompasses not only the discovery of vulnerabilities but also the development of essential tools, the cultivation of talent through education, the meticulous documentation of knowledge, the swift and effective response to security incidents, and the overarching effort to build a more resilient ecosystem for all.
By championing and funding these vital public goods security initiatives, the program has effectively integrated new tools, groundbreaking research, and actionable intelligence into the broader Ethereum ecosystem. This decentralized approach to defense fortifies the foundation upon which builders and users worldwide can operate with greater confidence. The Ethereum Foundation expresses profound gratitude to all 17 stipend recipients for their dedicated contributions. Special thanks are extended to The Red Guild for their hands-on involvement in reviewing submissions, structuring project milestones, and providing invaluable detailed feedback throughout the program’s duration. The collaborative efforts of Secureum and Security Alliance in establishing and guiding the program have also been instrumental to its success. The outcomes of the ETH Rangers Program serve as a compelling blueprint for future initiatives aimed at securing decentralized networks, highlighting the power of distributed expertise and collaborative effort in safeguarding the future of blockchain technology.
