ETH Rangers Program Recap

The Genesis of a Decentralized Defense Strategy

The Ethereum network, as the backbone of a multi-trillion-dollar decentralized finance (DeFi) and Web3 economy, faces unique and constantly evolving security challenges. Unlike centralized systems, its open-source, permissionless nature necessitates a collective, community-driven approach to defense. Recognizing this imperative, the Ethereum Foundation, a non-profit organization dedicated to supporting Ethereum and related technologies, partnered with specialized security organizations to launch the ETH Rangers Program. Secureum, known for its comprehensive security education and auditing expertise; The Red Guild, a collective of independent security researchers; and Security Alliance (SEAL), a prominent community-led security collective, brought their collective knowledge and networks to bear on this crucial undertaking.

The program’s core objective was elegantly straightforward: to identify and fund independent efforts that demonstrably enhance the overall resilience of the Ethereum ecosystem. It aimed to acknowledge and support individuals and groups with proven track records of meaningful contributions to security work benefiting Ethereum as a whole, often in areas that are less visible but critically important. These "public goods" security efforts encompass everything from fundamental vulnerability research and the development of robust security tooling to comprehensive education, proactive threat intelligence gathering, and rapid incident response. The six-month duration allowed recipients sufficient time to make substantial progress on their respective projects, culminating in a recent announcement detailing the impressive outcomes of the 17 stipend recipients’ work.

A Broad Spectrum of Impact: Key Achievements

The breadth and depth of the output from the ETH Rangers are truly impressive, demonstrating the multifaceted nature of securing a global, decentralized platform. Their collective work has spanned crucial areas, including identifying protocol-level vulnerabilities, developing advanced security tools, enhancing developer education, improving threat intelligence capabilities, and bolstering incident response mechanisms. These results unequivocally underscore the principle that a decentralized network demands a decentralized defense, with independent researchers building infrastructure that promises to multiply security effects across the entire ecosystem.

Project Highlights: Deep Dives into Critical Contributions

Several projects stood out for their significant impact and innovative approaches:

SunSec & DeFiHackLabs: Empowering the Next Generation of Defenders

Under the leadership of SunSec and in collaboration with the vibrant DeFiHackLabs community, an extraordinary volume of security education and tooling work was delivered. This initiative focused on capacity building, recognizing that a robust defense relies on a well-informed and skilled community of security researchers. Over the stipend period, DeFiHackLabs:

Developed and delivered numerous in-depth security workshops and educational materials, covering advanced topics in smart contract security, exploit analysis, and defensive strategies.
Published a series of highly technical articles and analyses on recent exploits and emerging attack vectors, providing invaluable insights to the broader security community.
Maintained and expanded their open-source repository of security tools and exploit examples, serving as a critical resource for learning and research.
Facilitated community discussions and mentorship programs, fostering a collaborative environment for hundreds of aspiring and experienced security researchers.

The sheer scale of community activation achieved by DeFiHackLabs is remarkable. By leveraging a single stipend, SunSec and their collaborators acted as a powerful multiplier, transforming initial funding into educational output that reached and upskilled hundreds of security researchers globally. This focus on education is vital for building a sustainable, proactive security posture within the rapidly expanding Ethereum ecosystem.

Ketman Project: Countering State-Sponsored Threats

One recipient utilized their stipend to build and significantly scale the Ketman Project, a highly specialized initiative focused on identifying and expelling North Korean (DPRK) IT workers who have covertly infiltrated blockchain projects under deceptive identities. This work directly addresses one of the most pressing and insidious operational security threats facing the Ethereum ecosystem today, given the DPRK’s documented history of state-sponsored cyber warfare aimed at funding illicit activities through crypto theft. Over the stipend period, the Ketman Project:

Developed sophisticated methodologies and intelligence gathering techniques to detect patterns and indicators of compromise associated with DPRK IT workers.
Successfully identified and reported numerous instances of suspected DPRK infiltration within various blockchain projects, leading to their removal and mitigation of potential threats.
Contributed to a confidential intelligence database, enhancing the collective understanding of DPRK tactics, techniques, and procedures (TTPs) in the blockchain space.
Provided crucial training and awareness materials to project teams, helping them to recognize and prevent future infiltration attempts.

This project’s contribution is paramount, as state-sponsored actors like those from the DPRK represent a sophisticated and persistent threat, capable of long-term infiltration and significant financial damage. The Ketman Project’s proactive efforts are a critical line of defense against such high-level operational security risks.

Nick Bax: Incident Response and Threat Intelligence at the Forefront

Nick Bax, a recognized expert in blockchain security, contributed across multiple crucial fronts, primarily through active participation in SEAL 911 incident response, DPRK threat mitigation, and public awareness campaigns. His work highlights the necessity of rapid, coordinated responses in the event of security breaches. During the program, Nick Bax:

Played a pivotal role in multiple SEAL 911 incident responses, contributing expertise to mitigate active exploits, coordinate with affected projects, and facilitate communication within the security community. SEAL 911 acts as an emergency response team for critical Web3 incidents, providing immediate support and coordination.
Provided expert analysis and intelligence on DPRK-related threats, contributing directly to efforts like the Ketman Project and enhancing the ecosystem’s understanding of these adversaries.
Published timely threat intelligence reports and analyses, disseminating crucial information about emerging vulnerabilities and attack campaigns to a wider audience, thereby raising overall security awareness.
Engaged with developers and project teams to provide actionable security advice, helping to implement preventative measures based on real-world incident data.

Bax’s multi-pronged approach demonstrates the interconnectedness of incident response, threat intelligence, and community education in building a resilient security framework.

Guild Audits: Cultivating Global Security Talent

Guild Audits undertook an impactful initiative by running intensive smart contract security bootcamps, specifically targeting the training of the next generation of Ethereum security researchers. This effort is crucial for addressing the persistent talent gap in blockchain security. Their program achieved significant milestones:

Successfully conducted multiple cohorts of smart contract security bootcamps, providing hands-on training to a diverse group of participants.
Focused on reaching underrepresented regions, particularly in Africa, to foster a more globally distributed and inclusive security community. This strategic focus helps to diversify perspectives and strengthen the network’s decentralized nature.
Equipped participants with practical skills in vulnerability identification, exploit development, and secure coding practices, preparing them for roles in auditing and security research.
Established a mentorship network, connecting bootcamp graduates with experienced security professionals to provide ongoing guidance and career development opportunities.

The capacity-building impact of Guild Audits’ smart contract security bootcamps is profoundly significant, creating a pipeline of skilled security researchers in regions that have been historically underrepresented in the Ethereum security community. This global expansion of expertise contributes directly to a stronger, more diverse defense.

Palina Tolmach & Kontrol: Making Formal Verification Accessible

Palina Tolmach of Runtime Verification dedicated her efforts to improving Kontrol, a cutting-edge formal verification tool for Ethereum smart contracts. Formal verification is a rigorous method that uses mathematical proofs to guarantee the correctness of software, thereby eliminating entire classes of vulnerabilities. Her work focused on making this powerful but often complex tool more accessible to a wider audience of developers and security researchers. Key Kontrol improvements delivered include:

Enhanced the user interface and overall user experience of Kontrol, simplifying the process of writing formal specifications and interpreting verification results.
Developed comprehensive documentation and tutorials, significantly lowering the barrier to entry for new users and making advanced formal verification techniques more understandable.
Integrated Kontrol with popular development environments and workflows, streamlining its adoption within existing project pipelines.
Added support for new Solidity features and EVM opcodes, ensuring the tool remains relevant and effective for the latest smart contract designs.

All of this critical work is open-source and publicly available at github.com/runtimeverification/kontrol, fundamentally improving the formal verification tooling landscape for all security researchers and fostering a culture of verifiable security.

Ethereum Execution Client DoS Research: Strengthening Network Fundamentals

A dedicated research team focused on developing a robust testing framework to systematically evaluate the resilience of Ethereum execution clients under message-flooding denial-of-service (DoS) attacks. DoS attacks pose a significant threat to network stability and decentralization, potentially leading to service disruption and even chain splits. By rigorously testing all five major execution clients (Geth, Besu, Erigon, Nethermind, and Reth), the team made a crucial discovery: 14 distinct bugs were identified across different network protocol layers. These vulnerabilities could lead to severe consequences:

Node crashes: Compromising the stability and availability of individual nodes, which are the backbone of the network.
Network partitioning: Leading to a fragmentation of the network, where different nodes see different states of the blockchain, undermining consensus.
Resource exhaustion: Causing nodes to consume excessive CPU, memory, or bandwidth, rendering them unresponsive or ineffective.

The findings highlight that no execution client is completely immune to message-flooding attacks, underscoring the continuous need for vigilance and improvement. The testing framework and comprehensive results have been shared directly with the Ethereum Foundation’s Protocol Security team, providing invaluable data to inform further client security research and the development of effective countermeasures, such as adaptive rate-limiting mechanisms.

Beyond the Highlights: Diverse Contributions to Public Goods Security

While space limits a full write-up for all recipients, the remaining ETH Rangers made equally valuable contributions across a wide spectrum of security-related public goods:

Kelsie Nabben: Authored a seminal book based on 2.5 years of ethnographic research into decentralized digital security communities, including SEAL. Her work provides critical sociological insights into how security is built and maintained within these unique structures.
Mothra team: Developed Mothra, a Ghidra extension for EVM bytecode reverse engineering, complete with support for EOF decompilation. They also published detailed technical write-ups, providing essential tools for understanding and analyzing compiled smart contracts.
SomaXBT: Published a four-part series on blockchain forensics and the crypto threat landscape, offering in-depth coverage of fund tracing, attribution techniques, and Open-Source Intelligence (OSINT) methods, crucial for post-incident analysis and prevention.
Peter Kacherginsky: Launched BlockThreat, an innovative platform for blockchain threat intelligence that systematically analyzes past blockchain security incidents to identify root causes and inform future defensive strategies.
Attack Vectors: Built attackvectors.org, an open-source, continuously updated guide detailing the top attack vectors in DeFi, alongside recommended prevention strategies. They also contributed significantly to SEAL’s Wallet Security Framework and became a SEAL Steward, deepening their commitment to community security.
Tim Fan: Developed D2PFuzz, a DevP2P protocol fuzzing framework, featuring differential testing capabilities across multiple execution layer clients. His work uncovered bugs through both single-client and cross-client testing, improving network protocol robustness.
nft_dreww: Contributed by publishing impactful security articles, hosting educational classes through Boring Security, and conducting audits on various Ethereum public goods projects, directly enhancing project security.
Jean-Loïc Mugnier: Created a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they reach the wallet. This vital tool, coupled with his simulation spoofing research, significantly enhances user-facing security against phishing and malicious approvals.
Alexandre Melo: Produced a series of high-quality security workshop videos, covering essential topics like fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs, making complex security concepts accessible.
Ho Nhut Minh: Enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and a Golang library for seamless integration with the Medusa fuzzer. Benchmarked on Nvidia H100 GPUs, this work dramatically speeds up security analysis.
Sergio Garcia: Built the Tracelon Monitoring Bot, a Telegram bot offering real-time block monitoring on Ethereum, Bitcoin, and Base, complete with ERC20 balance change alerts. He also continued his critical contributions to SEAL 911 incident response, showcasing his dedication to real-time defense.

Looking Ahead: Sustaining a Secure Ethereum

The ETH Rangers Program was conceived with a clear purpose: to champion and support individuals engaged in the often "unglamorous" but undeniably essential work of securing Ethereum. The rich variety of contributions from the 17 stipend recipients vividly illustrates the expansive definition of "public goods security" in practice. It extends far beyond merely discovering bugs; it encompasses the fundamental acts of building robust tools, educating and training new talent, meticulously documenting knowledge, responding swiftly to incidents, and ultimately, fortifying the entire ecosystem against an ever-evolving threat landscape.

By strategically supporting these public goods security initiatives, the program successfully integrated new tools, cutting-edge research, and critical intelligence directly into the broader Ethereum ecosystem. This decentralized approach to defense is not just an ideal; it is a practical necessity that provides a stronger, more resilient foundation for builders, developers, and users worldwide. The success of this inaugural program sets a powerful precedent for future initiatives, highlighting the efficacy of targeted funding for independent security researchers.

The Ethereum Foundation extends its profound gratitude to all 17 stipend recipients for their invaluable contributions and unwavering dedication. Special acknowledgment is also due to The Red Guild for their hands-on involvement in reviewing submissions, meticulously structuring milestones, and providing detailed, constructive feedback throughout the entire program. Furthermore, sincere thanks are offered to Secureum and Security Alliance for their collaborative spirit and expertise in establishing and guiding the ETH Rangers Program, ensuring its success and significant impact on the future security of Ethereum. The program’s conclusion is not an end, but a testament to the ongoing, collaborative effort required to safeguard the decentralized future.