clet.xyz

In late 2024, a significant initiative aimed at bolstering the security of the Ethereum ecosystem reached a pivotal milestone. The Ethereum Foundation, in collaboration with prominent security organizations Secureum, The Red Guild, and Security Alliance (SEAL), successfully concluded the six-month ETH Rangers Program. This groundbreaking initiative was designed to provide crucial stipends to individuals dedicated to public goods security work within Ethereum, recognizing and funding their vital, often underappreciated, contributions to the network’s resilience.

The program’s objective was clear and ambitious: to foster and fund independent efforts that fortify the Ethereum ecosystem’s security posture. This included not only identifying vulnerabilities but also developing robust tooling, disseminating knowledge, and enhancing overall threat intelligence. A core tenet of the ETH Rangers Program was to acknowledge and support individuals who had already demonstrated a tangible impact through their security work, benefiting the entire Ethereum community.

Now that the intensive six-month period has drawn to a close, the full scope of the 17 stipend recipients’ achievements is coming to light. The breadth and depth of their collective output are truly impressive, spanning critical areas such as in-depth vulnerability research, the development of essential security tooling, comprehensive educational initiatives, sophisticated threat intelligence gathering, and swift incident response. This diverse range of contributions underscores a fundamental truth about securing a decentralized network: it requires a decentralized defense. The independent researchers, through their focused efforts from protocol-level vulnerability discovery to global developer education, have collectively built infrastructure and knowledge that will amplify security benefits across the entire Ethereum landscape.

Project Highlights: Pillars of Ethereum’s Decentralized Security

The success of the ETH Rangers Program is best illustrated by the impactful work undertaken by its recipients. These projects represent a significant step forward in strengthening Ethereum’s security fabric through specialized, independent efforts.

SunSec and DeFiHackLabs: Scaling Security Education and Tooling

The collaborative efforts of SunSec, spearheaded by the tenacious researcher behind the SunWeb3Sec moniker, and the vibrant DeFiHackLabs community have resulted in an extraordinary volume of security education and tooling development. During the stipend period, DeFiHackLabs achieved remarkable milestones:

• Development of 10+ educational modules: These modules covered a wide spectrum of smart contract security topics, making complex concepts accessible to a broader audience.
• Creation of 5 new security tools: These tools aim to assist developers and auditors in identifying and mitigating potential vulnerabilities, streamlining the security assessment process.
• Publication of over 50 security articles and analyses: These written works provided valuable insights into emerging threats, best practices, and vulnerability disclosures, contributing significantly to the collective knowledge base.
• Organization of 3 community-driven security events: These events fostered collaboration, knowledge sharing, and networking opportunities for security professionals within the Ethereum space.

The sheer scale of community activation demonstrated by DeFiHackLabs is particularly noteworthy. Operating as a force multiplier, the project transformed a single stipend into an educational output that has the potential to reach hundreds, if not thousands, of aspiring and established security researchers. This model of decentralized knowledge dissemination is crucial for building a robust and skilled security workforce.

Ketman Project: Combating Sophisticated Infiltration Threats

One recipient dedicated their stipend to significantly enhancing and scaling the Ketman Project. This initiative is critically focused on identifying and actively expelling North Korean (DPRK) IT workers who have, in a sophisticated and concerning trend, infiltrated various blockchain projects by operating under false identities.

Over the duration of the stipend, the Ketman Project achieved the following:

• Developed advanced identity verification methodologies: These methods are designed to detect the sophisticated deception tactics employed by state-sponsored actors.
• Identified and reported numerous suspected DPRK operatives: Through rigorous investigation and cross-referencing of data, the project has flagged individuals whose digital footprints suggest affiliation with illicit DPRK operations.
• Collaborated with exchanges and project teams: Sharing intelligence and findings with relevant stakeholders to facilitate the removal of compromised personnel and prevent further damage.
• Published detailed reports on DPRK infiltration tactics: Educating the broader ecosystem about the modus operandi of these adversaries and the critical need for vigilance.

This work directly addresses one of the most pressing and insidious operational security threats currently facing the Ethereum ecosystem. The persistence of DPRK operatives poses a significant risk not only to individual projects but also to the overall integrity and trustworthiness of decentralized technologies.

Nick Bax: Fortifying Incident Response and Threat Intelligence

Nick Bax emerged as a multifaceted contributor, significantly impacting Ethereum’s security through his work across several key areas. His primary contributions included:

• Active participation in SEAL 911 incident response: Bax played a crucial role in the rapid and effective response to security incidents, providing critical analysis and support during high-pressure situations.
• Direct contributions to DPRK threat mitigation: Leveraging insights gained from his research, he actively worked to identify and counter the threat posed by North Korean IT workers, complementing the efforts of the Ketman Project.
• Enhancing public awareness and education: Through various channels, Bax worked to educate developers and users about emerging threats and best practices for securing decentralized applications and infrastructure.
• Development of threat intelligence frameworks: He contributed to the creation and refinement of tools and methodologies for gathering, analyzing, and disseminating actionable threat intelligence within the Ethereum community.

Bax’s comprehensive approach highlights the interconnectedness of incident response, threat intelligence, and public education in building a resilient security posture for any complex technological ecosystem.

Guild Audits: Cultivating Security Expertise in Africa and Beyond

Guild Audits has made a profound impact by running intensive smart contract security bootcamps, effectively training the next generation of Ethereum security researchers. This initiative is particularly vital for fostering a more diverse and globally representative security talent pool.

The bootcamps offered by Guild Audits have:

• Trained over 200 aspiring security researchers: Providing them with the foundational knowledge and practical skills necessary for smart contract auditing and vulnerability discovery.
• Focused on practical, hands-on learning: Emphasizing real-world application and problem-solving to ensure graduates are job-ready.
• Created specialized learning tracks: Covering areas such as advanced auditing techniques, formal verification, and exploit development.
• Built a strong alumni network: Facilitating ongoing collaboration and knowledge sharing among graduates.

The capacity-building impact of Guild Audits’ bootcamps is significant. They are creating a vital pipeline of skilled security researchers, particularly in regions that have historically been underrepresented in the global Ethereum security community. This expansion of talent is crucial for the long-term health and decentralization of Ethereum’s security efforts.

Palina Tolmach and Kontrol: Advancing Usable Formal Verification

Palina Tolmach, affiliated with Runtime Verification, dedicated her stipend to the crucial task of enhancing Kontrol, a formal verification tool specifically designed for Ethereum smart contracts. The primary goal was to make this powerful tool more accessible and user-friendly for a wider range of developers and security researchers, thereby democratizing the use of formal methods in smart contract development.

Key improvements delivered to the Kontrol tool include:

• Streamlined user interface and documentation: Making it easier for new users to understand and deploy the tool without extensive prior knowledge of formal verification.
• Expanded support for advanced EVM features: Ensuring Kontrol can effectively analyze contracts utilizing the latest Ethereum Virtual Machine capabilities.
• Integration with popular development environments: Allowing seamless incorporation of Kontrol into existing developer workflows, reducing friction and encouraging adoption.
• Development of illustrative case studies: Demonstrating the practical application of Kontrol in identifying complex bugs and verifying critical smart contract properties.

All of this work is publicly available and open-source on GitHub, significantly contributing to the formal verification tooling landscape and empowering security researchers across the ecosystem. The increased usability of such tools is paramount for shifting the paradigm towards proactively building more secure smart contracts.

Ethereum Execution Client DoS Research: Uncovering Network Vulnerabilities

A dedicated research team focused on a critical aspect of network resilience: the robustness of Ethereum execution clients against denial-of-service (DoS) attacks. They developed a sophisticated testing framework designed to systematically evaluate how these clients perform under intense message-flooding scenarios.

This rigorous testing, applied across all five major execution clients—Geth, Besu, Erigon, Nethermind, and Reth—uncovered a significant number of vulnerabilities:

• Discovery of 14 bugs: These critical flaws were identified across various network protocol layers, indicating a widespread vulnerability across different client implementations.
• Potential for network instability: The discovered bugs could lead to node instability, network partitioning (isolating nodes from the rest of the network), and increased resource consumption on affected nodes.
• Impact on consensus mechanisms: In extreme cases, these DoS vulnerabilities could potentially disrupt the consensus process, impacting the security and availability of the Ethereum network.

The findings unequivocally highlight that no single execution client is immune to message-flooding attacks. This research underscores the urgent need for continued efforts to develop and implement effective countermeasures, such as adaptive rate-limiting mechanisms. The comprehensive testing framework and the detailed findings have been shared with the Ethereum Foundation’s Protocol Security team, providing invaluable data to inform future client security research and development.

Other Stipend Recipients: A Diverse Array of Security Contributions

While the detailed write-ups above highlight some of the most extensive projects, the ETH Rangers Program supported a total of 17 recipients whose contributions spanned a wide spectrum of essential security-related public goods. For the sake of brevity, a comprehensive overview of all individual projects is not feasible here, but their collective impact is undeniable. These recipients have enriched the ecosystem through diverse outputs:

• Kelsie Nabben authored a seminal book, "Decentralised Digital Security: Community Inscriptions," drawing on 2.5 years of ethnographic research into decentralized digital security communities, including invaluable insights from SEAL. This work provides a crucial human-centric perspective on the challenges and triumphs of building secure decentralized systems.
• The Mothra team developed Mothra, a powerful Ghidra extension for EVM bytecode reverse engineering, complete with support for EOF decompilation. Their detailed technical write-ups on the development process offer valuable resources for security researchers working with low-level EVM code.
• SomaXBT published an insightful four-part series on blockchain forensics, delving into fund tracing, attribution techniques, and OSINT methods, offering crucial tools for understanding and responding to illicit activities within the crypto space.
• Peter Kacherginsky launched BlockThreat, a dedicated platform for blockchain threat intelligence that meticulously analyzes past security incidents and their root causes, providing a historical database for learning and prevention.
• Attack Vectors created attackvectors.org, an open-source, continuously updated guide detailing the top attack vectors in Decentralized Finance (DeFi) alongside effective prevention strategies. They also made significant contributions to SEAL’s Wallet Security Framework and were appointed as SEAL Stewards.
• Tim Fan developed D2PFuzz, a DevP2P protocol fuzzing framework that employs differential testing across multiple execution layer clients, successfully identifying bugs through both single-client and cross-client analysis.
• nft_dreww consistently published security articles, hosted educational classes through Boring Security, and conducted audits on critical Ethereum public goods projects, contributing to a more secure and informed ecosystem.
• Jean-Loïc Mugnier developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they are executed by the wallet, alongside conducting crucial research into simulation spoofing techniques.
• Alexandre Melo produced a series of valuable security workshop videos covering a broad range of topics, including fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs, expanding educational resources for the community.
• Ho Nhut Minh enhanced CuEVM, a GPU-accelerated EVM implementation, by integrating multi-GPU support and a Golang library for seamless integration with the Medusa fuzzer, benchmarking performance on high-end Nvidia H100 GPUs.
• Sergio Garcia built the Tracelon Monitoring Bot, a Telegram bot providing real-time block monitoring across Ethereum, Bitcoin, and Base, complete with ERC20 balance change alerts. He also continued his vital contributions to SEAL’s 911 incident response efforts.

Looking Ahead: A Decentralized Defense for a Decentralized Future

The ETH Rangers Program was conceived with a singular, vital purpose: to champion and support individuals engaged in the often unglamorous but absolutely essential security work that underpins the Ethereum ecosystem. The remarkable diversity of the contributions made by the 17 stipend recipients vividly illustrates the multifaceted nature of "public goods security" in practice. It extends far beyond the mere identification of bugs; it encompasses the creation of indispensable tools, the cultivation of new talent through education, the meticulous documentation of knowledge, the swift and effective response to critical incidents, and the continuous effort to make the entire ecosystem more robust and resilient.

By strategically investing in and supporting public goods security work, the ETH Rangers Program has successfully integrated a wealth of new tools, cutting-edge research, and actionable intelligence into the broader Ethereum ecosystem. This decentralized approach to defense is not merely a strategy; it is a foundational principle that provides a stronger, more adaptable, and more secure environment for builders and users worldwide.

The Ethereum Foundation, alongside its collaborative partners, expresses profound gratitude to all 17 stipend recipients for their invaluable contributions. Special recognition is extended to The Red Guild for their hands-on involvement in meticulously reviewing submissions, structuring program milestones, and providing detailed, constructive feedback throughout the process. Furthermore, sincere thanks are due to Secureum and Security Alliance for their instrumental collaboration in establishing and guiding this vital program. The success of the ETH Rangers Program serves as a powerful testament to the efficacy of a community-driven, decentralized approach to securing the future of blockchain technology.