clet.xyz

In late 2024, a significant initiative aimed at bolstering the security of the Ethereum ecosystem was launched, bringing together key organizations and independent security researchers. The Ethereum Foundation, in collaboration with Secureum, The Red Guild, and the Security Alliance (SEAL), unveiled the ETH Rangers Program. This program was designed to provide stipends to individuals dedicated to performing essential public goods security work within the Ethereum network. The core objective was clear: to foster and fund independent efforts that enhance the overall resilience of Ethereum and to acknowledge individuals who have consistently demonstrated a commitment to impactful security contributions benefiting the entire network.

As the six-month ETH Rangers Program recently concluded, the fruits of the labor of its 17 stipend recipients are now being shared. The scope of their output has proven to be remarkably diverse and impressive, spanning critical areas such as in-depth vulnerability research, the development of robust security tooling, comprehensive educational initiatives, advanced threat intelligence gathering, and proactive incident response. These collective outcomes underscore a fundamental truth in the realm of decentralized networks: securing such systems necessitates a similarly decentralized defense strategy. Across the board, these independent researchers have been instrumental in building foundational infrastructure and disseminating knowledge that will amplify security benefits throughout the entire Ethereum ecosystem, from the deepest protocol layers to global developer education.

Genesis and Goals of the ETH Rangers Program

The inception of the ETH Rangers Program was a strategic response to the growing complexity and evolving threat landscape within the burgeoning Ethereum ecosystem. As the network’s adoption surged and its functionalities expanded, so too did the potential attack surfaces and the sophistication of malicious actors. Recognizing that a centralized approach to security could be a bottleneck, the Ethereum Foundation, alongside established security collectives like Secureum, The Red Guild, and SEAL, decided to empower a distributed network of security professionals.

The program’s design prioritized independence and impact. Stipends were not merely grants; they were investments in individuals with proven track records in security. This approach ensured that resources were directed towards those already contributing meaningfully, enabling them to dedicate more time and focus to their critical work without the immediate pressure of securing traditional funding. The initiative aimed to bridge the gap between individual expertise and collective ecosystem security, fostering a collaborative environment where valuable security insights and tools could be developed and shared openly.

Project Highlights: A Multi-Faceted Defense

The ETH Rangers Program has yielded a rich tapestry of security advancements, with several recipients standing out for their significant contributions:

SunSec – DeFiHackLabs: Amplifying Security Education and Tooling

SunSec, in partnership with the vibrant DeFiHackLabs community, has delivered an extraordinary volume of security education and tooling. During the stipend period, DeFiHackLabs achieved several key milestones:

• Creation of Comprehensive Educational Content: They developed and disseminated a substantial amount of educational material, including detailed tutorials, practical guides, and insightful analysis of common smart contract vulnerabilities. This content was made freely available to the broader developer community.
• Development of Open-Source Security Tools: The team contributed to the development and refinement of open-source security tools designed to assist developers in identifying and mitigating potential risks in their smart contract code. These tools often focused on specific DeFi protocols or common exploitation patterns.
• Community Engagement and Knowledge Sharing: DeFiHackLabs actively fostered a community of security researchers, organizing workshops, engaging in discussions on security best practices, and facilitating peer-to-peer learning. Their efforts were particularly effective in onboarding new talent into the security domain.

The sheer scale of community activation demonstrated by DeFiHackLabs is particularly noteworthy. Operating as a powerful multiplier, the project effectively transformed a single stipend into widespread educational output that has reached hundreds of aspiring and established security researchers. This decentralized approach to knowledge dissemination is crucial for building a robust and knowledgeable developer base.

Ketman Project – DPRK IT Worker Investigations: Combating Sophisticated Threats

One recipient channeled their stipend into significantly scaling the Ketman Project. This initiative is dedicated to identifying and expelling North Korean (DPRK) IT workers who have infiltrated blockchain projects under assumed identities. These actors often pose a significant threat, potentially engaging in malicious activities such as draining funds, manipulating markets, or stealing intellectual property.

Over the stipend period, the Ketman Project achieved the following:

• Enhanced Detection Methodologies: The project developed and refined advanced techniques for identifying North Korean operatives, leveraging a combination of open-source intelligence (OSINT), network analysis, and forensic accounting.
• Expulsion of Malicious Actors: Through their diligent investigative work, the project successfully identified and facilitated the removal of multiple North Korean operatives from various blockchain projects, thereby preventing potential financial losses and security breaches.
• Dissemination of Threat Intelligence: The findings and methodologies of the Ketman Project were shared with relevant stakeholders, including project teams and security organizations, to raise awareness and bolster collective defenses against this specific threat.

This work directly addresses one of the most pressing operational security threats currently facing the Ethereum ecosystem, highlighting the critical need for specialized intelligence and proactive countermeasures against state-sponsored cybercrime.

Nick Bax – Incident Response and Threat Intelligence: A Crucial Defensive Layer

Nick Bax’s contributions spanned multiple critical areas, primarily through his involvement with SEAL 911 incident response, DPRK threat mitigation, and public awareness campaigns. His work provided a vital layer of defense and intelligence gathering:

• Active Incident Response: As part of the SEAL 911 initiative, Nick Bax was actively involved in responding to security incidents within the Ethereum ecosystem, providing rapid analysis, containment, and remediation efforts to minimize damage.
• DPRK Threat Mitigation: He played a role in identifying and countering the activities of North Korean IT workers, aligning with the efforts of projects like Ketman. This involved threat analysis and contributing to the development of defensive strategies.
• Public Awareness and Education: Nick Bax contributed to raising awareness about prevalent security threats and best practices within the Ethereum community through articles, presentations, and community engagement.

His multifaceted involvement underscores the interconnectedness of various security functions, from real-time incident management to strategic threat mitigation and proactive education.

Guild Audits – Security Education in Africa and Beyond: Building Future Talent

Guild Audits has been instrumental in fostering the next generation of Ethereum security researchers through intensive smart contract security bootcamps. Their efforts are particularly impactful in regions that have historically been underrepresented in the global cybersecurity landscape:

• Comprehensive Bootcamp Curriculum: Guild Audits developed and delivered a rigorous curriculum covering essential concepts in smart contract security, including vulnerability analysis, secure coding practices, and auditing methodologies.
• Global Reach and Accessibility: The bootcamps were designed to be accessible to a wide range of participants, with a focus on empowering individuals from diverse geographical backgrounds, including significant outreach into Africa.
• Pipeline for Skilled Professionals: By training aspiring security researchers, Guild Audits is creating a vital pipeline of skilled professionals who can contribute to the security of the Ethereum ecosystem and beyond.

The capacity-building impact of these bootcamps is significant, cultivating a more diverse and capable pool of security talent ready to tackle the complex challenges of decentralized systems.

Palina Tolmach – Kontrol: Usable Formal Verification

Palina Tolmach, affiliated with Runtime Verification, focused on enhancing Kontrol, a sophisticated formal verification tool for Ethereum smart contracts. The goal was to make this powerful tool more accessible and user-friendly for a broader audience of developers and security researchers:

• Improved User Interface and Experience: Significant improvements were made to Kontrol’s interface, simplifying its operation and making it easier for users to interact with the formal verification process.
• Enhanced Verification Capabilities: The tool’s underlying verification engines were optimized, leading to improved performance and the ability to analyze more complex smart contract logic.
• Expanded Documentation and Tutorials: Comprehensive documentation and practical tutorials were developed to guide users through the process of applying formal verification to their smart contracts, lowering the barrier to entry.

All of this work has been made open source, contributing to the broader landscape of formal verification tooling and empowering security researchers with more effective methods for ensuring smart contract correctness and security.

Ethereum Execution Client DoS Research: Strengthening Network Robustness

A dedicated research team developed a sophisticated testing framework to systematically evaluate the robustness of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. This critical research aimed to identify vulnerabilities that could disrupt network operations:

• Systematic Testing of Execution Clients: The framework was applied to all five major Ethereum execution clients: Geth, Besu, Erigon, Nethermind, and Reth.
• Discovery of 14 Bugs: The testing revealed a total of 14 bugs across various network protocol layers within these clients. These vulnerabilities could potentially lead to:
  • Resource Exhaustion: Attackers could exploit these bugs to consume excessive CPU or memory resources on nodes, leading to performance degradation.
  • Network Instability: The exploitation of certain bugs could result in node crashes or network partitions, compromising the overall stability of the Ethereum network.
  • Increased Latency and Block Propagation Delays: Flooding nodes with malformed or excessive messages could significantly slow down transaction processing and block propagation.

The findings underscore that no single execution client is entirely immune to message-flooding attacks. The research highlights the urgent need for further development of effective countermeasures, such as adaptive rate-limiting mechanisms, to bolster the resilience of the network. The testing framework and its findings have been shared with the Ethereum Foundation’s Protocol Security team, providing valuable insights to inform future client security enhancements.

Other Stipend Recipients: A Diverse Portfolio of Security Contributions

Beyond these highlighted projects, the ETH Rangers Program supported a wide array of other impactful security initiatives:

• Kelsie Nabben: Authored a book, "Decentralised Digital Security Community," drawing on extensive ethnographic research into decentralized digital security communities, including SEAL. This provides invaluable qualitative insights into the human element of blockchain security.
• Mothra Team: Developed Mothra, a Ghidra extension specifically designed for EVM bytecode reverse engineering. This tool includes support for EOF (Ethereum Object Format) decompilation, aiding in the analysis of compiled smart contracts. Detailed technical write-ups on its development process were also published.
• SomaXBT: Produced a comprehensive four-part series on blockchain forensics and the crypto threat landscape. This series delved into fund tracing, attribution techniques, and the effective use of OSINT methods for security investigations.
• Peter Kacherginsky: Launched BlockThreat, a dedicated platform for blockchain threat intelligence. This initiative analyzes past blockchain security incidents and their root causes, offering valuable lessons for future prevention.
• Attack Vectors: Created attackvectors.org, an open-source, continuously updated guide detailing the most prevalent attack vectors in Decentralized Finance (DeFi), alongside strategies for their prevention. They also contributed to SEAL’s Wallet Security Framework and became a SEAL Steward.
• Tim Fan: Developed D2PFuzz, a fuzzing framework specifically for the DevP2P protocol. This framework incorporates differential testing across multiple execution layer clients, successfully identifying bugs through both single-client and cross-client testing.
• nft_dreww: Contributed significantly through security articles, educational classes hosted by Boring Security, and by completing audits on various Ethereum public goods projects, demonstrating a broad commitment to ecosystem security.
• Jean-Loïc Mugnier: Developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they are broadcast to the wallet. This work also included research into simulation spoofing techniques.
• Alexandre Melo: Produced a series of security workshop videos covering a wide range of topics, including fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs, making advanced security knowledge more accessible.
• Ho Nhut Minh: Enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and a Golang library for seamless integration with the Medusa fuzzer. Performance benchmarks were conducted on high-end Nvidia H100 GPUs.
• Sergio Garcia: Built the Tracelon Monitoring Bot, a Telegram bot designed for real-time block monitoring across Ethereum, Bitcoin, and Base. The bot provides crucial alerts for ERC20 balance changes and continues to contribute to SEAL 911 incident response efforts.

Looking Ahead: The Enduring Impact of Decentralized Security

The ETH Rangers Program has successfully demonstrated that supporting public goods security work is not merely about identifying and fixing bugs; it encompasses a much broader spectrum of activities essential for a robust ecosystem. This includes the development of innovative tools, the dissemination of critical knowledge through education, the meticulous documentation of security best practices, the swift and effective response to security incidents, and the continuous effort to make the entire ecosystem more resilient.

The program’s diverse contributions have integrated new tools, cutting-edge research, and vital intelligence into the fabric of the Ethereum network. This decentralized approach to defense establishes a stronger, more adaptable foundation for developers and users worldwide. The success of the ETH Rangers Program highlights the power of empowering independent researchers and fostering collaborative security efforts.

The Ethereum Foundation expresses its profound gratitude to all 17 stipend recipients for their invaluable contributions. Special recognition is extended to The Red Guild for their hands-on involvement in reviewing submissions, structuring project milestones, and providing detailed, constructive feedback throughout the program’s duration. Thanks are also due to Secureum and the Security Alliance for their collaborative efforts in establishing and guiding this crucial initiative. The program’s conclusion marks not an end, but a stepping stone towards a more secure and resilient future for Ethereum, built by a community dedicated to its collective well-being.