clet.xyz

In a significant move to bolster the security and resilience of the Ethereum ecosystem, the Ethereum Foundation, in collaboration with prominent security organizations Secureum, The Red Guild, and Security Alliance (SEAL), launched the ETH Rangers Program in late 2024. This ambitious initiative aimed to provide crucial financial support in the form of stipends to individuals dedicated to public goods security work within Ethereum. The program’s core objective was to foster and fund independent efforts that enhance the overall robustness of the decentralized network, while simultaneously recognizing and rewarding individuals who have consistently demonstrated their commitment and delivered meaningful contributions to vital security initiatives benefiting the entire Ethereum community.

As the six-month tenure of the ETH Rangers Program draws to a close, a comprehensive review of its impact reveals a remarkably diverse and impressive array of outputs from its 17 stipend recipients. Their work spans critical areas such as in-depth vulnerability research, the development of essential security tooling, comprehensive educational initiatives, sophisticated threat intelligence gathering, and proactive incident response. This concerted effort underscores a fundamental truth in the realm of decentralized networks: securing such complex systems necessitates a similarly decentralized and multifaceted defense strategy. The independent researchers supported by the ETH Rangers Program have collectively built crucial infrastructure, ranging from protocol-level vulnerability analysis to global developer education, creating a ripple effect that amplifies security benefits across the entire Ethereum ecosystem.

Project Highlights and Key Contributions

The inaugural cohort of ETH Rangers has delivered a wide spectrum of impactful projects, underscoring the breadth and depth of security expertise within the Ethereum community.

SunSec – DeFiHackLabs: Scaling Security Education

SunSec, in partnership with the DeFiHackLabs community, has emerged as a powerful force in security education and tooling development. Over the course of the stipend period, DeFiHackLabs achieved remarkable feats:

• Extensive Educational Content: Produced over 100 educational articles and tutorials covering a wide range of smart contract security topics.
• Tooling Development: Contributed significantly to the development and maintenance of several open-source security tools, enhancing their usability and accessibility for the broader developer community.
• Community Engagement: Organized and facilitated numerous online workshops and security challenges, directly engaging hundreds of aspiring and established security researchers.
• Vulnerability Disclosure: Actively participated in bug bounty programs, responsibly disclosing critical vulnerabilities found in various Ethereum projects.

The sheer scale of community activation driven by DeFiHackLabs is particularly noteworthy. By leveraging the stipend, the project has effectively operated as a multiplier, transforming a single grant into a widespread educational outreach program that has reached and empowered a substantial number of security researchers. This approach democratizes access to high-quality security knowledge, a critical factor in building a more secure decentralized future.

Ketman Project – DPRK IT Worker Investigations: Addressing a Critical Threat

One of the ETH Rangers utilized their stipend to significantly advance the Ketman Project, an initiative dedicated to identifying and mitigating the presence of North Korean (DPRK) IT workers who have infiltrated blockchain projects under fraudulent identities. This work directly confronts one of the most pressing operational security threats currently facing the Ethereum ecosystem. During the stipend period, the Ketman Project achieved the following:

• Identification of Infiltrators: Successfully identified and documented a significant number of DPRK IT workers posing as legitimate developers across various blockchain platforms.
• Disruption of Operations: Provided actionable intelligence that led to the disruption of illicit operations orchestrated by these infiltrators.
• Enhanced Due Diligence: Developed and disseminated best practices for project teams to implement more robust identity verification and background check processes.
• Public Awareness Campaign: Launched a targeted campaign to raise awareness within the blockchain industry about the tactics and dangers posed by DPRK state-sponsored cyber threats.

The proactive nature of this research is invaluable. By exposing and combating these malicious actors, the Ketman Project contributes to the integrity and trustworthiness of the entire decentralized finance (DeFi) landscape.

Nick Bax – Incident Response and Threat Intelligence: A Multifaceted Approach

Nick Bax demonstrated exceptional versatility, contributing across multiple critical security domains. His work primarily focused on SEAL 911 incident response, mitigating DPRK-related threats, and raising public awareness about emerging security challenges. Key contributions include:

• Incident Response: Played a pivotal role in responding to several high-profile security incidents within the Ethereum ecosystem, helping to contain damage and facilitate recovery efforts.
• Threat Intelligence Sharing: Contributed significantly to SEAL’s threat intelligence repository, providing detailed analysis and actionable insights on emerging attack vectors and threat actors.
• Public Education: Authored articles and delivered presentations on blockchain security best practices, educating developers and users on how to protect themselves from common threats.
• Collaboration: Fostered strong working relationships with other security researchers and organizations, promoting a collaborative approach to ecosystem security.

Bax’s contributions highlight the importance of seasoned professionals who can both respond to immediate threats and contribute to the long-term strategic security posture of the network.

Guild Audits – Security Education in Africa and Beyond: Building Global Capacity

Guild Audits has been instrumental in cultivating the next generation of Ethereum security researchers through intensive smart contract security bootcamps. The impact of these programs extends far beyond mere technical training, focusing on building capacity in regions historically underrepresented in the cybersecurity landscape. Over the stipend period, Guild Audits achieved:

• Comprehensive Bootcamps: Conducted multiple intensive bootcamps, equipping participants with advanced knowledge in smart contract auditing, vulnerability analysis, and secure development practices.
• Global Reach: Successfully trained individuals from diverse geographical locations, with a particular focus on empowering security talent in Africa and other emerging markets.
• Curriculum Development: Developed and refined a robust curriculum that integrates theoretical knowledge with practical, hands-on exercises.
• Community Building: Fostered a supportive network for graduates, encouraging ongoing collaboration and knowledge sharing within the burgeoning security community.

The capacity-building impact of Guild Audits’ bootcamps is profound, creating a vital pipeline of skilled security researchers. This initiative is crucial for diversifying the Ethereum security community and ensuring that security expertise is accessible globally, thereby strengthening the network’s overall defense capabilities.

Palina Tolmach – Kontrol: Usable Formal Verification: Enhancing Tooling Accessibility

Palina Tolmach, associated with Runtime Verification, dedicated her stipend to enhancing Kontrol, a powerful formal verification tool for Ethereum smart contracts. Her work focused on making this sophisticated tool more accessible and user-friendly for both developers and security researchers. Key improvements delivered for Kontrol include:

• Simplified User Interface: Implemented significant enhancements to the user interface, making it more intuitive and easier to navigate for users with varying levels of technical expertise.
• Improved Documentation: Developed comprehensive and accessible documentation, including detailed tutorials and examples, to lower the barrier to entry for new users.
• Integration with Development Workflows: Facilitated smoother integration of Kontrol into existing smart contract development workflows, enabling developers to incorporate formal verification earlier in the development lifecycle.
• Performance Optimizations: Undertook performance optimizations to ensure the tool operates efficiently, even when verifying complex smart contracts.

All of the work on Kontrol is openly available on GitHub, contributing to the broader landscape of formal verification tooling and empowering security researchers with more robust methods for ensuring smart contract correctness.

Ethereum Execution Client DoS Research: Strengthening Network Infrastructure

A dedicated research team focused on the critical area of Ethereum execution client security. They developed a sophisticated testing framework designed to systematically evaluate the resilience of these clients against message-flooding denial-of-service (DoS) attacks. This research involved rigorous testing of all five major execution clients: Geth, Besu, Erigon, Nethermind, and Reth. The team’s efforts led to the discovery of 14 bugs across various network protocol layers. These vulnerabilities have the potential to cause:

• Resource Exhaustion: Leading to excessive CPU and memory consumption, potentially crashing client nodes.
• Network Disruption: Causing nodes to temporarily or permanently disconnect from the network, impacting transaction propagation and consensus.
• Performance Degradation: Significantly slowing down client operations, affecting the overall efficiency of the Ethereum network.

The findings underscore a crucial reality: no single execution client is entirely impervious to message-flooding attacks. This research highlights the ongoing need for enhanced countermeasures, such as adaptive rate-limiting mechanisms, to fortify these foundational components of the Ethereum network. The testing framework and detailed results have been shared with the Ethereum Foundation’s Protocol Security team, providing essential data to inform future client security research and development.

Other Stipend Recipients: A Broad Spectrum of Security Contributions

While the detailed write-ups above highlight some of the most extensive projects, the ETH Rangers Program supported a diverse group of individuals whose contributions, though varied, are equally vital to the ecosystem’s security.

• Kelsie Nabben authored a significant book based on her extensive ethnographic research into decentralized digital security communities, including SEAL, providing invaluable insights into the human and social dimensions of security.
• The Mothra team developed Mothra, a Ghidra extension for EVM bytecode reverse engineering, including support for EOF decompilation, and published detailed technical documentation of their development process.
• SomaXBT produced a comprehensive four-part series on blockchain forensics, detailing fund tracing, attribution techniques, and OSINT methods relevant to the crypto threat landscape.
• Peter Kacherginsky launched BlockThreat, a platform dedicated to blockchain threat intelligence that analyzes past security incidents and their root causes.
• Attack Vectors created attackvectors.org, an open-source, continuously updated guide to DeFi’s top attack vectors and their prevention strategies, while also contributing to SEAL’s Wallet Security Framework.
• Tim Fan developed D2PFuzz, a DevP2P protocol fuzzing framework with differential testing capabilities across multiple execution layer clients, leading to the discovery of several bugs.
• nft_dreww published security articles, hosted educational classes through Boring Security, and completed audits on Ethereum public goods projects.
• Jean-Loïc Mugnier developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they reach the wallet, alongside research into simulation spoofing.
• Alexandre Melo produced a series of security workshop videos covering topics such as fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs.
• Ho Nhut Minh enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and a Golang library for integration with the Medusa fuzzer, with benchmarks conducted on Nvidia H100 GPUs.
• Sergio Garcia built the Tracelon Monitoring Bot, a Telegram bot for real-time block monitoring on Ethereum, Bitcoin, and Base, featuring ERC20 balance change alerts, and continued contributing to SEAL 911 incident response.

Looking Ahead: A Decentralized Defense for a Decentralized Future

The ETH Rangers Program successfully achieved its core objective: to support individuals engaged in the often unglamorous yet fundamentally essential security work that underpins the Ethereum ecosystem. The diverse range of contributions from the 17 stipend recipients vividly illustrates the multifaceted nature of "public goods security." This encompasses not only the identification and remediation of vulnerabilities but also the creation of crucial tools, the dissemination of knowledge through education, the meticulous documentation of threats, the swift and effective response to incidents, and the continuous effort to enhance the overall resilience of the network.

By investing in public goods security work, the program has demonstrably integrated new tools, groundbreaking research, and vital intelligence into the broader Ethereum ecosystem. This decentralized approach to defense establishes a more robust and secure foundation for builders, developers, and users worldwide. The Ethereum Foundation, along with its collaborative partners Secureum, The Red Guild, and Security Alliance, expressed deep gratitude to all 17 stipend recipients for their invaluable contributions. Special recognition was given to The Red Guild for their hands-on involvement in reviewing submissions, structuring project milestones, and providing detailed feedback throughout the program’s duration. The foundational collaboration with Secureum and Security Alliance in establishing the program was also acknowledged as critical to its success. The outcomes of the ETH Rangers Program serve as a powerful testament to the efficacy of decentralized funding and collaborative effort in fortifying the future of blockchain technology.