clet.xyz

In late 2024, a significant initiative aimed at bolstering the security of the Ethereum network, the ETH Rangers Program, successfully concluded its inaugural six-month run. Spearheaded by the Ethereum Foundation in collaboration with prominent security organizations Secureum, The Red Guild, and Security Alliance (SEAL), the program provided vital stipends to individuals dedicated to crucial public goods security work within the Ethereum ecosystem. The program’s core objective was to empower and fund independent efforts that demonstrably enhance the resilience and integrity of Ethereum, recognizing and rewarding individuals with a proven track record of impactful contributions to the network’s overall security.

The conclusion of this pioneering program marks a critical juncture, allowing for an assessment of the tangible outcomes delivered by its 17 stipend recipients. The scope of their collective work has been remarkably broad, spanning critical areas such as in-depth vulnerability research, the development of essential security tooling, comprehensive educational initiatives, sophisticated threat intelligence gathering, and agile incident response capabilities. These diverse contributions underscore a fundamental principle: the security of a decentralized network like Ethereum necessitates a decentralized, multifaceted defense strategy. The independent researchers supported by the ETH Rangers Program have effectively constructed vital infrastructure and disseminated knowledge that will amplify security benefits across the entire Ethereum landscape, from the deepest protocol layers to global developer communities.

The Genesis and Goals of the ETH Rangers Program

The establishment of the ETH Rangers Program arose from a recognized need to systematically support and incentivize the often unheralded but indispensable security work that underpins the Ethereum ecosystem. While the core development of Ethereum is a public good, the security of its vast and intricate network relies on continuous vigilance, proactive research, and the development of robust defensive mechanisms. The Ethereum Foundation, alongside its esteemed partners, identified that a decentralized network requires a similarly decentralized approach to security funding and recognition.

The program was meticulously designed to address this gap by offering financial stipends, thereby enabling researchers to dedicate their time and expertise to critical security tasks without the immediate pressure of commercial pressures. The selection process emphasized demonstrated impact and a clear commitment to the public good, ensuring that resources were directed towards individuals and projects with the highest potential to benefit the entire Ethereum community. The six-month duration was chosen to allow for substantial project development and measurable outcomes, providing a clear timeframe for evaluation and reporting.

Project Highlights: A Deep Dive into Key Contributions

The outputs from the ETH Rangers Program demonstrate a profound commitment to strengthening Ethereum’s security posture through diverse and impactful projects.

SunSec – DeFiHackLabs: Amplifying Security Education and Tooling

Under the banner of SunSec, and in close partnership with the DeFiHackLabs community, a substantial volume of security education and tooling work was delivered. The DeFiHackLabs initiative, a testament to the power of community-driven efforts, effectively transformed a single stipend into a force multiplier for security awareness and skill development. During the program’s tenure, DeFiHackLabs achieved several key milestones:

• Extensive Educational Content: The creation and dissemination of a vast repository of security educational materials, including detailed guides, tutorials, and workshops focused on smart contract security and common vulnerabilities.
• Development of Security Tools: The development and open-sourcing of practical security tools designed to assist developers and auditors in identifying and mitigating risks within their smart contracts and decentralized applications (dApps).
• Community Engagement and Training: Active engagement with a broad community of security researchers, providing them with the knowledge and resources to enhance their skills and contribute more effectively to the ecosystem’s security.

The sheer scale of community activation achieved by DeFiHackLabs is particularly noteworthy. By leveraging a decentralized model, the project effectively amplified the impact of the stipend, reaching hundreds of security researchers and fostering a more robust security culture within the Ethereum space. This approach exemplifies how targeted funding can catalyze widespread positive security outcomes.

Ketman Project – DPRK IT Worker Investigations: Tackling Sophisticated Threats

One recipient dedicated their stipend to the critical mission of building and scaling the Ketman Project. This initiative is specifically focused on identifying and mitigating the persistent threat posed by North Korean (DPRK) IT workers who have been found to infiltrate blockchain projects under false identities. The strategic importance of this work cannot be overstated, as these actors often engage in malicious activities, including illicit fund acquisition and the introduction of vulnerabilities. Over the stipend period, the Ketman Project achieved significant progress:

• Enhanced Detection Mechanisms: Development and refinement of advanced methodologies and tools for identifying North Korean operatives within the global blockchain workforce, utilizing a combination of open-source intelligence (OSINT) and network analysis.
• Disruption of Malicious Operations: Active engagement in uncovering and reporting instances of DPRK infiltration, leading to the disruption of potential malicious activities and the safeguarding of project integrity.
• Threat Intelligence Dissemination: Sharing critical intelligence with relevant stakeholders, including project teams and security organizations, to raise awareness and facilitate coordinated responses to this persistent threat.

This targeted effort directly addresses one of the most pressing operational security challenges currently facing the Ethereum ecosystem, demonstrating a proactive and vital contribution to its overall security.

Nick Bax – Incident Response and Threat Intelligence: A Multi-Faceted Approach

Nick Bax’s contributions spanned multiple critical areas of Ethereum security, primarily focusing on incident response, threat mitigation, and public awareness. Operating under the umbrella of SEAL 911 incident response, Bax played a crucial role in addressing immediate security threats and enhancing the ecosystem’s preparedness. His key achievements included:

• Proactive Threat Mitigation: Active participation in identifying and mitigating threats, particularly those originating from North Korean state-sponsored actors, contributing to a safer operational environment for projects and users.
• Rapid Incident Response: Providing expertise and support during security incidents, aiding in the containment, investigation, and recovery phases to minimize damage and restore affected systems.
• Public Awareness Campaigns: Developing and disseminating information to raise public awareness about emerging security threats and best practices, empowering users and developers to better protect themselves.

Bax’s work exemplifies the critical need for individuals who can respond effectively to crises and proactively identify and neutralize threats before they can cause widespread harm.

Guild Audits – Security Education in Africa and Beyond: Cultivating Future Talent

Guild Audits spearheaded intensive smart contract security bootcamps, a vital initiative aimed at training and cultivating the next generation of Ethereum security researchers. Recognizing the global disparities in access to specialized cybersecurity education, this program focused on empowering individuals in regions historically underrepresented in the blockchain security community. The impact of Guild Audits’ bootcamps has been significant:

• Capacity Building: Providing rigorous, hands-on training in smart contract security principles, auditing methodologies, and common vulnerability exploitation and prevention techniques.
• Pipeline Development: Creating a pipeline of skilled security researchers, equipping them with the expertise to contribute to the security of Ethereum and other blockchain networks.
• Global Reach: Successfully delivering educational programs to participants across Africa and other underserved regions, fostering a more diverse and inclusive global security landscape.

The capacity-building impact of these bootcamps is a strategic investment in the long-term security and sustainability of the Ethereum ecosystem, addressing a critical need for skilled professionals worldwide.

Palina Tolmach – Kontrol: Usable Formal Verification: Enhancing Tooling Accessibility

Palina Tolmach, in collaboration with Runtime Verification, focused on enhancing Kontrol, a powerful formal verification tool for Ethereum smart contracts. The goal was to significantly improve the tool’s usability and accessibility for a broader audience of developers and security researchers. Formal verification is a crucial but often complex discipline, and making such tools more approachable is vital for widespread adoption and enhanced security. Key Kontrol improvements delivered include:

• Streamlined User Interface: Developing a more intuitive and user-friendly interface, reducing the learning curve for individuals unfamiliar with formal verification techniques.
• Expanded Verification Capabilities: Enhancing Kontrol’s ability to verify a wider range of smart contract properties and identify more subtle or complex vulnerabilities.
• Integration with Development Workflows: Facilitating smoother integration of Kontrol into existing smart contract development and auditing workflows, making it a more practical tool for daily use.

All of this work is publicly available on GitHub, contributing to the open-source formal verification tooling landscape and empowering security researchers with more robust and accessible tools for ensuring smart contract correctness.

Ethereum Execution Client DoS Research: Fortifying Network Infrastructure

A dedicated research team developed a sophisticated testing framework designed to systematically evaluate the robustness of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. These attacks, if successful, can cripple network operations by overwhelming nodes with excessive data. The team rigorously tested all five major execution clients (Geth, Besu, Erigon, Nethermind, and Reth), a critical component of the Ethereum network’s infrastructure.

Their comprehensive testing uncovered a significant number of vulnerabilities:

• 14 Bugs Discovered: A total of 14 bugs were identified across different network protocol layers within the tested execution clients.
• Potential Impacts: These vulnerabilities, if exploited, could lead to:
  • Node Crashes: Causing individual nodes to become unresponsive and disconnect from the network.
  • Network Partitioning: Disrupting communication between nodes, potentially leading to consensus issues and network instability.
  • Resource Exhaustion: Draining server resources, impacting performance and availability.

The findings underscore a critical reality: no single execution client is entirely impervious to message-flooding attacks. The research highlights the ongoing need for robust countermeasures, such as adaptive rate-limiting mechanisms, to further strengthen client resilience. The research framework and its findings have been shared with the Ethereum Foundation’s Protocol Security team, providing invaluable insights to inform future client security research and development.

Other Notable Stipend Recipients and Their Contributions

Beyond the detailed highlights, the ETH Rangers Program supported a diverse array of projects contributing to the broader security landscape. For brevity, a full write-up on each recipient’s project is not feasible here, but their contributions are equally vital to the ecosystem’s security.

• Kelsie Nabben produced a book, "Decentralised Digital Security: A Community Inscriptions," drawing on 2.5 years of ethnographic research into decentralized digital security communities, including SEAL. This work provides valuable qualitative insights into the human element of cybersecurity in Web3.
• The Mothra team developed Mothra, a Ghidra extension for EVM bytecode reverse engineering, with added support for EOF decompilation. They also published detailed technical write-ups on their development process, offering valuable resources for reverse engineers.
• SomaXBT published a comprehensive four-part series on blockchain forensics and the crypto threat landscape, covering fund tracing, attribution techniques, and OSINT methods. This series serves as an educational resource for investigators and security professionals.
• Peter Kacherginsky launched BlockThreat, a platform dedicated to blockchain threat intelligence. BlockThreat analyzes past blockchain security incidents and their root causes, offering valuable historical data and analytical insights.
• Attack Vectors created attackvectors.org, an open-source, continuously updated guide detailing the top attack vectors in DeFi and offering prevention strategies. They also contributed to SEAL’s Wallet Security Framework and became a SEAL Steward, demonstrating broad engagement.
• Tim Fan developed D2PFuzz, a DevP2P protocol fuzzing framework that employs differential testing across multiple execution layer clients. This framework has already identified bugs through both single-client and cross-client testing.
• nft_dreww contributed through security articles, educational classes via Boring Security, and audits on Ethereum public goods projects, actively engaging in education and direct security enhancements.
• Jean-Loïc Mugnier developed a Web3 transaction simulation Chrome extension designed to intercept and simulate transactions before they reach the wallet, alongside research into simulation spoofing.
• Alexandre Melo produced a series of security workshop videos covering a range of critical topics including fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs.
• Ho Nhut Minh enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and a Golang library for integration with the Medusa fuzzer, benchmarking performance on high-end GPUs.
• Sergio Garcia built the Tracelon Monitoring Bot, a Telegram bot providing real-time block monitoring for Ethereum, Bitcoin, and Base, with alerts for ERC20 balance changes. He also continued contributing to SEAL 911 incident response.

Looking Ahead: The Enduring Impact of Decentralized Defense

The ETH Rangers Program’s success serves as a powerful testament to the efficacy of supporting individuals engaged in the often-unglamorous, yet critically essential, security work that underpins the Ethereum network. The sheer diversity of contributions from the 17 stipend recipients vividly illustrates the multifaceted nature of "public goods security" in practice. It encompasses far more than merely identifying software vulnerabilities; it extends to the crucial development of robust tools, the dissemination of vital knowledge through education, the diligent documentation of best practices, the rapid and effective response to security incidents, and the overall enhancement of the ecosystem’s resilience against evolving threats.

By strategically investing in public goods security initiatives, the ETH Rangers Program has successfully integrated novel tools, groundbreaking research, and actionable intelligence into the broader Ethereum ecosystem. This decentralized approach to defense cultivates a more robust and secure foundation for builders, developers, and users worldwide. The Ethereum Foundation, in conjunction with Secureum, The Red Guild, and Security Alliance, expresses deep gratitude to all 17 stipend recipients for their invaluable contributions. Special acknowledgment is due to The Red Guild for their hands-on involvement in reviewing submissions, structuring project milestones, and providing critical feedback throughout the program’s duration. The collaborative efforts of Secureum and Security Alliance in establishing and guiding this vital program are also highly appreciated. The lessons learned and the groundwork laid by the ETH Rangers Program are poised to inform and inspire future initiatives aimed at securing the decentralized future of Ethereum.