In late 2024, a significant initiative aimed at bolstering the security of the Ethereum ecosystem reached a pivotal milestone. The Ethereum Foundation, in collaboration with prominent security organizations Secureum, The Red Guild, and Security Alliance (SEAL), successfully concluded the six-month ETH Rangers Program. This groundbreaking initiative provided stipends to independent security researchers and practitioners dedicated to strengthening the resilience and safety of the Ethereum network. The program’s objective was clear: to foster and fund vital, often underappreciated, security work that directly benefits the entire Ethereum community.
The ETH Rangers Program was conceived as a direct response to the growing complexity and evolving threat landscape surrounding decentralized networks. As Ethereum continues its rapid expansion, securing its infrastructure becomes an increasingly critical task. The program sought to empower individuals and small teams who possess the expertise and dedication to tackle these challenges head-on, recognizing their proven track records of meaningful contributions to Ethereum’s security. By offering financial support, the initiative aimed to remove potential barriers to entry and allow these security guardians to focus their efforts on critical public goods.
Upon the program’s conclusion, the breadth and depth of the 17 stipend recipients’ output have been revealed, underscoring the program’s success. The work spans a diverse range of crucial security domains, including in-depth vulnerability research, the development of essential security tooling, comprehensive educational initiatives, proactive threat intelligence gathering, and responsive incident management. The consolidated outcomes from these independent efforts paint a compelling picture of a decentralized defense strategy in action, demonstrating that the security of a decentralized network truly requires a decentralized approach to its protection.
The very nature of these contributions highlights how individual researchers, armed with focused support, can build infrastructure and generate knowledge that amplifies security effects across the entire Ethereum ecosystem. From the granular analysis of protocol-level vulnerabilities to the broad dissemination of security knowledge to developers globally, these independent efforts are creating a more robust and secure foundation for everyone involved in Ethereum.
Project Highlights: Pillars of Decentralized Security
The ETH Rangers Program has spotlighted several key projects that exemplify the program’s impact. These initiatives showcase the diverse ways in which security expertise can be applied to enhance Ethereum’s resilience.
SunSec – DeFiHackLabs: Empowering the Next Generation of Security Researchers
SunSec, in partnership with the DeFiHackLabs community, has delivered an exceptional volume of security education and tooling. During the stipend period, DeFiHackLabs significantly expanded its reach and impact:
- Developed and disseminated 15 comprehensive security guides and tutorials covering a wide array of topics, from smart contract auditing best practices to exploit analysis.
- Created and maintained a curated repository of over 100 security-related tools and resources, making them readily accessible to the community.
- Organized and facilitated 5 interactive security workshops, drawing hundreds of participants eager to enhance their understanding of Ethereum security.
- Published 20 detailed post-mortems of significant DeFi hacks, providing invaluable lessons learned for developers and security professionals.
The sheer scale of community activation spearheaded by DeFiHackLabs is a testament to its effectiveness as a force multiplier. By leveraging the stipend, the project has transformed a single grant into widespread educational output, reaching and empowering hundreds of aspiring and established security researchers. This scalable approach to knowledge sharing is vital for building a robust and knowledgeable security community.
Ketman Project – DPRK IT Worker Investigations: Addressing a Pressing Threat
One recipient has dedicated their stipend to scaling the Ketman Project, a critical initiative focused on identifying and mitigating the threat posed by North Korean (DPRK) IT workers who have infiltrated blockchain projects under deceptive pretenses. This work directly confronts one of the most significant operational security challenges facing the Ethereum ecosystem today. Over the stipend period, the Ketman Project achieved the following:
- Successfully identified and reported over 50 confirmed DPRK IT workers operating within the blockchain space.
- Developed and implemented advanced techniques for detecting fake identities and employment anomalies, improving the efficacy of traditional background checks.
- Collaborated with multiple exchanges and project teams to facilitate the removal of identified DPRK operatives, thereby preventing potential malicious activities.
- Published anonymized threat intelligence reports detailing the modus operandi and evolving tactics of these operatives, aiding the broader community in defense.
This specialized investigation is crucial for maintaining the integrity of decentralized projects and protecting the trust that underpins the Ethereum ecosystem. By proactively identifying and addressing this sophisticated threat, the Ketman Project contributes significantly to the overall security posture.
Nick Bax – Incident Response and Threat Intelligence: A Multi-Faceted Contribution
Nick Bax has made substantial contributions across multiple critical security domains, primarily through his involvement with SEAL 911 incident response, DPRK threat mitigation, and public awareness campaigns. His work has been instrumental in both reacting to security events and proactively building defenses:
- Responded to and assisted in the mitigation of over 15 critical security incidents within the Ethereum ecosystem, providing rapid analysis and guidance.
- Authored detailed threat intelligence reports on DPRK operatives, complementing the work of the Ketman Project and providing actionable insights for broader industry awareness.
- Developed and presented educational materials on threat actor tactics, delivered through public forums and workshops, enhancing the community’s understanding of emerging risks.
- Contributed to the ongoing development and refinement of SEAL’s incident response frameworks, ensuring preparedness for future events.
Bax’s multifaceted approach highlights the interconnectedness of security efforts. His ability to contribute to both immediate incident response and long-term threat intelligence underscores the value of experienced practitioners in maintaining ecosystem health.
Guild Audits – Security Education in Africa and Beyond: Building Capacity Globally
Guild Audits has been instrumental in fostering the next generation of Ethereum security researchers through intensive smart contract security bootcamps. Their efforts are particularly impactful in regions historically underrepresented in the cybersecurity field. The bootcamps have achieved:
- Graduated over 100 participants from comprehensive smart contract security training programs, equipping them with the skills to identify and mitigate vulnerabilities.
- Established training partnerships with local tech communities in 5 African countries, creating a sustainable pipeline of skilled security talent.
- Developed a modular curriculum that has been adapted and shared with 3 other educational initiatives, amplifying the program’s reach.
- Facilitated direct mentorship opportunities for bootcamp graduates with established security professionals, aiding their transition into the industry.
The capacity-building impact of Guild Audits’ bootcamps is profound. By creating a pathway for individuals from diverse backgrounds to enter the Ethereum security space, they are not only strengthening the global security community but also promoting greater inclusivity and representation within the broader Web3 ecosystem.
Palina Tolmach – Kontrol: Usable Formal Verification: Enhancing Tooling Accessibility
Palina Tolmach, affiliated with Runtime Verification, has focused on enhancing Kontrol, a powerful formal verification tool for Ethereum smart contracts. The objective has been to make this sophisticated technology more accessible and user-friendly for developers and security researchers. Key Kontrol improvements delivered include:
- Streamlined the user interface and documentation, significantly reducing the learning curve for new users.
- Integrated new symbolic execution capabilities, enabling more comprehensive analysis of complex smart contract logic.
- Developed robust integrations with popular development environments, such as Hardhat and Foundry, allowing for seamless incorporation into existing workflows.
- Published open-source code and detailed usage guides on GitHub, ensuring that these advancements are available to the entire community.
All of this work is publicly available on GitHub, contributing to a richer formal verification tooling landscape. By making advanced verification techniques more accessible, Tolmach’s efforts empower a wider range of developers to build more secure smart contracts from the outset, reducing the likelihood of costly and damaging exploits.
Ethereum Execution Client DoS Research: Strengthening Core Infrastructure
A dedicated research team has developed a comprehensive testing framework designed to systematically evaluate the robustness of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. This is a critical area of research, as the performance and availability of execution clients are fundamental to the network’s operation.
- Tested all five major execution clients: Geth, Besu, Erigon, Nethermind, and Reth.
- Discovered a total of 14 bugs across various network protocol layers within these clients.
- Identified potential vulnerabilities that could lead to:
- Increased node resource consumption (CPU/memory): This can degrade network performance and potentially lead to instability.
- Network partition: In severe cases, DoS attacks could isolate nodes, disrupting consensus and transaction propagation.
- Node instability and crashes: Maliciously crafted messages could trigger software defects, causing nodes to become unresponsive or terminate unexpectedly.
The findings underscore a crucial reality: no single execution client is entirely immune to message-flooding attacks. This research highlights the ongoing need for robust countermeasures, such as adaptive rate-limiting mechanisms, to protect the network’s infrastructure. The testing framework and the discovered bugs have been shared directly with the Ethereum Foundation’s Protocol Security team, providing valuable insights to inform future client development and security hardening efforts.
Other Stipend Recipients: A Broad Spectrum of Security Contributions
While comprehensive write-ups for all recipients are not feasible within this summary, the remaining participants have made significant contributions across a wide array of security-related public goods. Their work further illustrates the diverse and essential nature of public goods security in the Ethereum ecosystem.
| Recipient | Output |
|---|---|
| Kelsie Nabben | Authored a book, "Decentralised Digital Security: A Community Inscriptions," drawing on 2.5 years of ethnographic research into decentralized digital security communities, including insights from SEAL. |
| Mothra team | Developed Mothra, a Ghidra extension for EVM bytecode reverse engineering, including support for EOF decompilation. Published detailed technical write-ups on the development process. |
| SomaXBT | Published a four-part series on blockchain forensics and the crypto threat landscape, covering fund tracing, attribution techniques, and OSINT methods on the Paragraph platform. |
| Peter Kacherginsky | Launched BlockThreat, a platform dedicated to blockchain threat intelligence, analyzing past blockchain security incidents and their root causes. |
| Attack Vectors | Created attackvectors.org, an open-source, continuously updated guide detailing top DeFi attack vectors with prevention strategies. Also contributed to SEAL’s Wallet Security Framework and became a SEAL Steward. |
| Tim Fan | Developed D2PFuzz, a DevP2P protocol fuzzing framework with differential testing across multiple execution layer clients, identifying bugs through both single-client and cross-client testing. |
| nft_dreww | Published security articles, hosted educational classes through Boring Security, and successfully completed security audits on Ethereum public goods projects. |
| Jean-Loïc Mugnier | Developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they reach the wallet, alongside research into simulation spoofing. |
| Alexandre Melo | Produced security workshop videos covering topics such as fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs, shared on his YouTube channel. |
| Ho Nhut Minh | Enhanced CuEVM, a GPU-accelerated EVM implementation, adding multi-GPU support and a Golang library for integration with the Medusa fuzzer, with benchmarks conducted on Nvidia H100 GPUs. |
| Sergio Garcia | Built the Tracelon Monitoring Bot, a Telegram bot for real-time block monitoring on Ethereum, Bitcoin, and Base with ERC20 balance change alerts. Continues to contribute to SEAL 911 incident response efforts. |
Looking Ahead: Sustaining the Momentum of Decentralized Defense
The ETH Rangers Program was established with a clear mission: to support the often unglamorous but fundamentally essential security work that underpins the Ethereum ecosystem. The diverse contributions from the 17 stipend recipients vividly illustrate the expansive definition of "public goods security" in practice. This work extends far beyond the mere identification of bugs; it encompasses the creation of vital tools, the cultivation of new talent through education, the meticulous documentation of knowledge, the swift response to critical incidents, and the overall enhancement of the ecosystem’s resilience against evolving threats.
By actively supporting these public goods security initiatives, the ETH Rangers Program has successfully integrated novel tools, critical research findings, and crucial intelligence into the broader Ethereum landscape. This decentralized approach to defense cultivates a more robust and secure foundation for developers, users, and builders worldwide.
The Ethereum Foundation extends its profound gratitude to all 17 stipend recipients for their invaluable contributions. Special thanks are due to The Red Guild for their hands-on involvement in reviewing submissions, structuring project milestones, and providing detailed feedback throughout the program’s duration. The foundational collaboration with Secureum and Security Alliance in establishing and guiding the program has also been instrumental to its success. As the program concludes, the insights and outputs generated serve as a powerful testament to the efficacy of investing in decentralized security expertise, paving the way for a more secure and resilient future for Ethereum.
