In late 2024, a significant initiative aimed at bolstering the security of the Ethereum ecosystem reached a pivotal milestone. The Ethereum Foundation, in collaboration with prominent security organizations Secureum, The Red Guild, and Security Alliance (SEAL), launched the ETH Rangers Program. This forward-thinking program was designed to provide crucial stipends for individuals actively engaged in public goods security work within the rapidly evolving Ethereum landscape. The overarching objective was clear: to foster and fund independent efforts that demonstrably enhance the resilience and robustness of the Ethereum network, while simultaneously recognizing and supporting individuals with a proven track record of meaningful contributions to security work that benefits the entire ecosystem.
The six-month duration of the ETH Rangers Program has now concluded, and the Ethereum Foundation, along with its partner organizations, has shared the impactful outcomes of the 17 stipend recipients’ dedicated efforts. The scope of their contributions is nothing short of impressive, spanning a wide array of critical security domains. These include in-depth vulnerability research, the development of essential security tooling, comprehensive educational initiatives, sophisticated threat intelligence gathering, and proactive incident response. The collective results underscore a fundamental truth: securing a decentralized network like Ethereum necessitates a decentralized approach to defense, leveraging the diverse skills and perspectives of a global community.
The ETH Rangers Program emerged from a recognized need to systematically support the often under-resourced but vital work of individual security researchers and small teams. While the Ethereum Foundation and major protocol developers invest heavily in security, the decentralized nature of the ecosystem means that countless crucial security enhancements originate from independent actors. The program aimed to bridge this gap by providing financial support, enabling these individuals to dedicate more time and resources to their security-focused projects without the immediate pressure of seeking traditional funding. This initiative recognized that a robust security posture for Ethereum is not solely the responsibility of core developers but a shared endeavor requiring broad community participation.
The timeline of the program began with the official launch announcement in late 2024, followed by a period of application review and selection. The six-month stipend period then commenced, during which the selected recipients actively pursued their projects. This concluding phase marks the culmination of their intensive work, with the released outcomes offering a tangible demonstration of the program’s success and the value of investing in decentralized security efforts.
Project Highlights: A Multifaceted Approach to Ecosystem Security
The outcomes from the ETH Rangers Program reveal a diverse and impactful set of projects, each contributing to the overall security and integrity of the Ethereum network. These initiatives represent a strategic investment in the long-term health of the ecosystem, building infrastructure and knowledge that will have a multiplier effect.
SunSec – DeFiHackLabs: Amplifying Security Education and Tooling
SunSec, in close collaboration with the vibrant DeFiHackLabs community, delivered an extraordinary volume of security education and tooling work. During the stipend period, DeFiHackLabs achieved significant milestones that underscore the power of community-driven security initiatives.
DeFiHackLabs focused on creating accessible and practical resources for the Ethereum security community. Their output included the development of new educational materials that demystified complex security concepts, making them understandable to a wider audience of developers and researchers. Furthermore, they actively contributed to the creation and refinement of open-source security tools. These tools are designed to assist developers in identifying vulnerabilities early in the development lifecycle, thereby reducing the likelihood of exploitable bugs making their way into production smart contracts. The sheer scale of community activation witnessed through DeFiHackLabs is particularly noteworthy. The project operates as a powerful multiplier, effectively transforming a single stipend into widespread educational output that reaches hundreds, if not thousands, of security researchers and developers globally. This distributed approach to knowledge dissemination is crucial for building a more secure and resilient Ethereum ecosystem.
Ketman Project – DPRK IT Worker Investigations: Addressing a Critical Geopolitical Threat
One recipient leveraged their stipend to significantly build and scale the Ketman Project. This crucial initiative is dedicated to identifying and expelling North Korean (DPRK) IT workers who have systematically infiltrated blockchain projects, often under fabricated identities. The threat posed by these state-sponsored actors is substantial, as they can potentially gain access to sensitive information, disrupt operations, or even compromise the integrity of decentralized applications and protocols.
Over the stipend period, the Ketman Project achieved several key objectives:
- Expanded Operational Scope: The project successfully broadened its reach, increasing the number of identified DPRK operatives and the volume of blockchain projects under investigation. This expansion allowed for a more comprehensive understanding of the infiltration tactics employed by these actors.
- Enhanced Detection Methodologies: New and refined methods for identifying DPRK IT workers were developed and implemented. These methodologies likely incorporate a combination of technical analysis, open-source intelligence (OSINT), and traditional investigative techniques, tailored to the unique challenges of the blockchain space.
- Deterrence and Mitigation: By actively exposing these operatives and their activities, the Ketman Project contributes directly to deterring future infiltration attempts. The public disclosure of findings also enables targeted mitigation strategies for affected projects and the broader ecosystem.
This work directly addresses one of the most pressing operational security threats facing the Ethereum ecosystem today. The success of the Ketman Project highlights the necessity of specialized research focused on sophisticated adversarial actors, a domain often requiring significant dedication and resources.
Nick Bax – Incident Response and Threat Intelligence: Fortifying the Defenses
Nick Bax made substantial contributions across multiple critical security fronts, primarily through his involvement with SEAL 911 incident response, DPRK threat mitigation, and public awareness campaigns. His multifaceted engagement demonstrates the interconnectedness of various security efforts within the Ethereum ecosystem.
Bax’s work in incident response provided vital support during security breaches and emergent threats, helping to contain damage and facilitate recovery for affected parties. His efforts in DPRK threat mitigation directly complemented the work of initiatives like the Ketman Project, contributing to a coordinated defense against state-sponsored adversarial activities. Furthermore, his focus on public awareness played a crucial role in educating the broader Ethereum community about emerging threats and best practices for safeguarding digital assets and protocols. The integration of these diverse activities underscores the value of individuals who can operate effectively across different facets of cybersecurity.
Guild Audits – Security Education in Africa and Beyond: Building Global Capacity
Guild Audits spearheaded intensive smart contract security bootcamps, playing a pivotal role in training the next generation of Ethereum security researchers. This initiative is particularly impactful for its focus on capacity building in regions that have historically been underrepresented in the global cybersecurity landscape.
The bootcamps provided participants with hands-on training in identifying and mitigating vulnerabilities in smart contracts. This curriculum likely covered a range of topics, including common attack vectors, secure coding practices, formal verification techniques, and the use of specialized security auditing tools. The capacity-building impact of Guild Audits’ smart contract security bootcamps is significant, creating a vital pipeline of skilled security researchers in regions that have been historically underserved by the broader Ethereum security community. By empowering individuals in these areas, Guild Audits is contributing to a more diverse and globally distributed security intelligence network.
Palina Tolmach – Kontrol: Usable Formal Verification for Smarter Contracts
Palina Tolmach, affiliated with Runtime Verification, focused on enhancing Kontrol, a sophisticated formal verification tool designed for Ethereum smart contracts. The primary objective of her work was to make Kontrol more accessible and user-friendly for a wider audience of developers and security researchers. Formal verification is a powerful technique that mathematically proves the correctness of software, offering a high degree of assurance against bugs and vulnerabilities.
Key Kontrol improvements delivered under the ETH Rangers Program include:
- Improved User Interface and Experience: Enhancements to the user interface and overall workflow of Kontrol were implemented, aiming to reduce the learning curve and make the tool more intuitive for those without extensive formal verification expertise.
- Expanded Verification Capabilities: The tool’s ability to verify a broader range of smart contract properties and patterns was likely extended, allowing for more comprehensive security analysis.
- Better Integration and Documentation: Efforts were made to improve Kontrol’s integration with existing development tools and ecosystems, alongside the creation of more thorough and accessible documentation.
All of this work is open-source, readily available on GitHub, and contributes to strengthening the formal verification tooling landscape for all security researchers. This commitment to open-source development ensures that the benefits of these advancements are widely shared across the Ethereum ecosystem.
Ethereum Execution Client DoS Research: Strengthening Network Infrastructure
A dedicated research team developed a comprehensive testing framework to systematically evaluate the robustness of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. These attacks aim to overwhelm network nodes with excessive data, potentially leading to network instability or complete disruption.
By rigorously testing all five major execution clients—Geth, Besu, Erigon, Nethermind, and Reth—the team uncovered a significant number of vulnerabilities. Their research identified 14 bugs distributed across different network protocol layers of these critical client implementations. These vulnerabilities, if exploited, could lead to a range of adverse effects, including:
- Node crashes or instability: Maliciously crafted messages could trigger unexpected errors or resource exhaustion, causing nodes to become unresponsive.
- Network partition or degradation: Widespread node failures could fragment the network, hindering consensus and transaction processing.
- Reduced network throughput: Even if not leading to complete failure, DoS attacks can significantly slow down transaction processing, impacting the usability of the Ethereum network.
The findings unequivocally highlight that no single execution client is entirely immune to message-flooding attacks. This underscores the ongoing need for continued development of effective countermeasures, such as adaptive rate-limiting mechanisms and more resilient network protocols. The testing framework and the detailed results have been shared with the Ethereum Foundation’s Protocol Security team, providing crucial insights to inform and guide future client security research and development efforts.
Other Stipend Recipients: A Broad Spectrum of Security Contributions
While the detailed write-ups cover several key projects, the ETH Rangers Program supported a total of 17 recipients, whose contributions span a wide and vital range of security-related public goods. For brevity, not all projects could be elaborated upon in extensive detail, but their impact is significant.
| Recipient | Output
