In late 2024, a significant initiative aimed at bolstering the security of the Ethereum ecosystem culminated, revealing a diverse array of impactful contributions from independent researchers and developers. The ETH Rangers Program, a collaborative effort spearheaded by the Ethereum Foundation in partnership with Secureum, The Red Guild, and the Security Alliance (SEAL), provided stipends to individuals dedicated to critical public goods security work. The program, spanning six months, aimed to foster and recognize independent efforts that enhance the overall resilience and security of the Ethereum network, funding individuals with proven track records of meaningful contributions.
The conclusion of this ambitious program has brought to light the impressive breadth and depth of the work undertaken by its 17 stipend recipients. Their output spans crucial areas such as advanced vulnerability research, the development of essential security tooling, comprehensive educational initiatives, sophisticated threat intelligence gathering, and rapid incident response. These collective achievements underscore a fundamental principle in securing a decentralized network: that a robust defense must also be decentralized, leveraging the collective expertise and dedication of a global community. The independent researchers, through their focused efforts, have not only identified potential weaknesses but also actively built infrastructure and disseminated knowledge that will amplify security benefits across the entire Ethereum ecosystem, from its foundational protocol layers to its vast network of developers and users.
The Genesis of the ETH Rangers Program
The genesis of the ETH Rangers Program can be traced to a recognized need within the rapidly evolving blockchain landscape. As Ethereum’s influence and complexity have grown, so too has the sophistication of threats targeting its infrastructure and user base. While the core development teams and established security firms play a vital role, a gap existed in systematically supporting and incentivizing independent security researchers who often operate on the fringes, tackling critical but less glamorous aspects of network security.
The Ethereum Foundation, alongside key partners like Secureum, known for its focus on security education and audits, The Red Guild, a collective of security professionals, and the Security Alliance (SEAL), a broader initiative for industry-wide security collaboration, conceptualized the ETH Rangers Program. The objective was clear: to provide financial support, or stipends, that would empower individuals to dedicate their time and expertise to public goods security work without the immediate pressure of direct commercial gain. This strategic investment aimed to cultivate a more resilient and secure Ethereum by fostering a decentralized defense mechanism, mirroring the very nature of the blockchain it sought to protect. The program’s launch in late 2024 marked a proactive step towards ensuring the long-term integrity and trustworthiness of the Ethereum network.
Project Highlights: A Decentralized Defense in Action
The outcomes of the ETH Rangers Program demonstrate a powerful synergy between independent research and community empowerment, illustrating how targeted funding can yield substantial security enhancements for the Ethereum ecosystem.
SunSec – DeFiHackLabs: Amplifying Security Education
SunSec, in collaboration with the vibrant DeFiHackLabs community, has delivered an exceptional volume of security education and tooling. During the stipend period, DeFiHackLabs achieved significant milestones, including the release of over 20 educational articles and tutorials covering a wide spectrum of smart contract security vulnerabilities and best practices. Furthermore, they developed and open-sourced at least three new security tools designed to assist developers in identifying common exploits, such as reentrancy attacks and integer overflows. The community also hosted a series of 10 live workshops, reaching hundreds of aspiring and established security researchers globally.
The scale of community activation by DeFiHackLabs is particularly noteworthy. Operating as a force multiplier, the project has effectively transformed a single stipend into a widespread educational outreach program. This initiative has not only disseminated critical security knowledge but also fostered a collaborative environment where hundreds of security researchers can learn, share, and contribute, thereby significantly multiplying the overall security impact across the Ethereum ecosystem. The community-driven approach ensures that the knowledge gained is practical, relevant, and accessible to a broad audience.
Ketman Project – DPRK IT Worker Investigations: Addressing a Critical Threat
One recipient channeled their stipend into building and scaling the Ketman Project, a crucial initiative focused on identifying and mitigating the infiltration of North Korean (DPRK) IT workers into blockchain projects. These individuals often operate under fraudulent identities, posing a significant operational security threat to the integrity of decentralized networks.
Over the stipend period, the Ketman Project successfully identified and reported over 50 suspected DPRK IT workers operating under false pretenses across various blockchain platforms, including significant efforts within the Ethereum ecosystem. This led to the deactivation of numerous fraudulent accounts and the prevention of potential exploits or data breaches. Additionally, the project published detailed investigative reports and threat analysis, raising awareness within the community and providing actionable intelligence to affected projects and security firms. This work directly confronts one of the most pressing and sophisticated operational security threats currently facing the Ethereum ecosystem, contributing to a more secure and trustworthy environment for all participants.
Nick Bax – Incident Response and Threat Intelligence: A Multi-Faceted Contribution
Nick Bax has made substantial contributions across multiple critical security domains. His primary focus has been on enhancing the SEAL 911 incident response capabilities, providing swift and effective support during security incidents within the Ethereum ecosystem. This has involved the development of new protocols for rapid triage and analysis of security breaches, as well as active participation in responding to numerous high-severity incidents.
Furthermore, Bax has been instrumental in DPRK threat mitigation efforts, working to identify and disrupt the activities of state-sponsored malicious actors. His research and intelligence gathering have provided vital insights into the tactics, techniques, and procedures employed by these sophisticated adversaries, enabling proactive defense strategies. Beyond technical contributions, Bax has also been a vocal advocate for public awareness, publishing articles and delivering presentations that educate the broader community about emerging threats and best practices in blockchain security. His work exemplifies a holistic approach to security, encompassing reactive incident response, proactive threat intelligence, and community-wide education.
Guild Audits – Security Education in Africa and Beyond: Building Capacity
Guild Audits has significantly impacted the global security landscape by conducting intensive smart contract security bootcamps. These programs are designed to train and equip the next generation of Ethereum security researchers, particularly focusing on regions historically underrepresented in the field. Over the stipend period, Guild Audits successfully trained over 150 participants across three major bootcamps held in different African cities.
The curriculum covered a comprehensive range of topics, including smart contract auditing methodologies, common vulnerability patterns, static and dynamic analysis techniques, and the use of advanced security tools. The impact of these bootcamps extends beyond individual skill development; they are actively building a pipeline of skilled security professionals in regions that have traditionally faced barriers to entry in the blockchain security community. This capacity-building initiative is crucial for fostering a more diverse and globally distributed security workforce, ultimately strengthening the resilience of the Ethereum ecosystem worldwide.
Palina Tolmach – Kontrol: Usable Formal Verification
Palina Tolmach, in her work with Runtime Verification, has focused on enhancing Kontrol, an open-source formal verification tool for Ethereum smart contracts. The primary goal has been to make this powerful tool more accessible and user-friendly for developers and security researchers, thereby democratizing access to formal verification techniques.
Key improvements to Kontrol delivered during the stipend period include the development of a more intuitive graphical user interface, simplifying the process of setting up and running verification checks. Significant progress was also made in improving the tool’s performance and scalability, allowing it to handle more complex smart contract systems efficiently. Additionally, Tolmach worked on expanding Kontrol’s library of pre-defined specifications and properties, enabling users to quickly verify common security invariants without needing to define them from scratch. All of this vital work is publicly available on GitHub, contributing to a richer landscape of formal verification tooling for the entire security research community.
Ethereum Execution Client DoS Research: Fortifying the Network Core
A dedicated research team utilized their stipend to develop a sophisticated testing framework designed to systematically evaluate the robustness of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. This research is critical as execution clients form the backbone of the Ethereum network, responsible for processing transactions and maintaining the blockchain’s state.
By rigorously testing all five major execution clients—Geth, Besu, Erigon, Nethermind, and Reth—the team uncovered a significant number of vulnerabilities. Their comprehensive analysis revealed a total of 14 bugs across various network protocol layers. These vulnerabilities, if exploited, could lead to severe network disruptions, including:
- Resource Exhaustion: Attackers could exploit these bugs to consume excessive CPU or memory resources on client nodes, leading to performance degradation or complete node crashes.
- Network Partitioning: Certain bugs could be leveraged to isolate nodes from the rest of the network, hindering consensus and transaction propagation.
- Temporary Service Unavailability: In specific scenarios, the identified vulnerabilities could render individual nodes or even larger segments of the network temporarily unresponsive to legitimate network traffic.
The findings underscore a critical reality: no single execution client is entirely immune to message-flooding attacks. This research highlights the urgent need for enhanced countermeasures, such as adaptive rate-limiting mechanisms and more resilient peer-to-peer networking protocols. The testing framework and the detailed results have been shared with the Ethereum Foundation’s Protocol Security team, providing invaluable data to inform ongoing client security research and development, ultimately strengthening the network’s resilience against sophisticated denial-of-service threats.
Other Stipend Recipients: A Broad Spectrum of Security Contributions
While not all projects could be detailed individually, the remaining stipend recipients contributed across a wide and impactful range of security-related public goods, further solidifying the decentralized defense strategy.
- Kelsie Nabben authored a book based on extensive ethnographic research into decentralized digital security communities, including SEAL, offering valuable insights into the human element of blockchain security.
- The Mothra team developed Mothra, a Ghidra extension for EVM bytecode reverse engineering, enhancing capabilities for analyzing and understanding compiled smart contract code, including support for the emerging EOF (Ethereum Object Format) decompilation.
- SomaXBT published a comprehensive four-part series on blockchain forensics and the crypto threat landscape, detailing fund tracing, attribution techniques, and open-source intelligence (OSINT) methods crucial for post-incident analysis.
- Peter Kacherginsky launched BlockThreat, a platform dedicated to blockchain threat intelligence, analyzing historical security incidents and their root causes to inform future prevention strategies.
- Attack Vectors created attackvectors.org, an open-source, continuously updated guide detailing prevalent DeFi attack vectors and their corresponding prevention strategies. They also became a SEAL Steward and contributed to the Wallet Security Framework.
- Tim Fan developed D2PFuzz, a DevP2P protocol fuzzing framework that employs differential testing across multiple execution layer clients, successfully identifying bugs through both single-client and cross-client analysis.
- nft_dreww significantly contributed through security articles, educational classes hosted by Boring Security, and completed audits on various Ethereum public goods projects.
- Jean-Loïc Mugnier developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they are confirmed by the wallet, alongside research into simulation spoofing vulnerabilities.
- Alexandre Melo produced a series of security workshop videos covering essential topics such as fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs.
- Ho Nhut Minh enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and a Golang library for integration with the Medusa fuzzer, achieving impressive benchmarks on high-performance GPUs.
- Sergio Garcia built the Tracelon Monitoring Bot, a Telegram bot providing real-time block monitoring for Ethereum, Bitcoin, and Base, with immediate alerts for ERC20 balance changes, while also continuing contributions to SEAL 911 incident response.
Looking Ahead: Sustaining Decentralized Security
The ETH Rangers Program has successfully demonstrated that by supporting individuals engaged in often unglamorous but essential security work, the Ethereum ecosystem can achieve substantial enhancements in its overall resilience. The diverse nature of the contributions—ranging from deep protocol-level vulnerability research to broad developer education, threat intelligence, incident response, and tooling development—underscores the multifaceted definition of "public goods security" in practice.
The program’s success lies not only in the tangible outputs of the stipend recipients but also in its integration of new tools, research, and intelligence into the broader Ethereum ecosystem. This decentralized approach to defense establishes a stronger, more adaptable foundation for builders, users, and developers worldwide. The Ethereum Foundation, in collaboration with Secureum, The Red Guild, and Security Alliance, has expressed gratitude to all 17 recipients for their invaluable contributions. Special recognition was given to The Red Guild for their hands-on involvement in reviewing submissions and structuring project milestones, and to Secureum and SEAL for their foundational collaboration in establishing the program. The positive outcomes of the ETH Rangers Program signal a promising future for decentralized security initiatives within the Ethereum space, encouraging continued investment and support for independent security research.
