ETH Rangers Program Recap

In late 2024, a pivotal collaboration between the Ethereum Foundation, Secureum, The Red Guild, and Security Alliance (SEAL) culminated in the launch of the ETH Rangers Program. This initiative was designed to provide essential stipends to individuals dedicating their efforts to public goods security work within the dynamic Ethereum ecosystem. The program’s core mission was clear and strategically vital: to fund independent endeavors that fortify the resilience of the Ethereum network and to formally acknowledge individuals with a proven history of significant contributions to the overarching security of Ethereum. Now, following a rigorous and productive six-month period, the program has concluded, revealing an impressive spectrum of achievements from its 17 stipend recipients. Their collective output spanned critical areas including vulnerability research, security tooling development, educational outreach, cutting-edge threat intelligence, and rapid incident response, underscoring the program’s success in fostering a robust, decentralized defense mechanism for the world’s leading smart contract platform.

The Imperative of Decentralized Security: A Background to the ETH Rangers Program

The genesis of the ETH Rangers Program can be traced back to the burgeoning complexities and increasing value locked within the Ethereum ecosystem. As decentralized finance (DeFi) protocols, NFTs, and various dApps proliferated, so did the financial incentives for malicious actors. The history of blockchain security is punctuated by high-profile incidents—from the infamous DAO hack in 2016, which led to the Ethereum Classic fork, to numerous DeFi exploits in recent years totaling billions of dollars in losses. These events starkly highlighted the need for a continuous, proactive, and multi-faceted approach to security that extends beyond individual projects to encompass the entire underlying infrastructure.

Public goods security, in the context of a decentralized network like Ethereum, refers to non-proprietary security efforts that benefit all participants without direct financial compensation for the contributors. This includes open-source security tools, shared threat intelligence, community-driven educational resources, and fundamental protocol research. Historically, such "unglamorous but essential" work has often been underfunded or left to the goodwill of volunteers. Recognizing this critical gap, the Ethereum Foundation, as a steward of the ecosystem, partnered with leading security organizations to create a structured mechanism for supporting these vital contributions. Secureum, known for its expertise in security education and audits, brought a wealth of knowledge in identifying and nurturing talent. The Red Guild, with its focus on security research and community building, was instrumental in structuring milestones and providing feedback. Security Alliance (SEAL), a collective dedicated to incident response and threat intelligence, provided a crucial operational link, grounding the program in real-world security needs. The ETH Rangers Program was thus conceived as a strategic intervention to professionalize and incentivize these critical public goods, moving towards a more resilient and secure future for Ethereum.

Program Mechanics and Strategic Objectives

Launched in late 2024, the ETH Rangers Program was designed with a dual objective: to fund independent security efforts and to recognize individuals with demonstrable track records of meaningful contributions. The stipend model was chosen to empower independent researchers and developers, offering them financial stability to dedicate focused attention to security challenges. The selection process, though not explicitly detailed, implicitly prioritized candidates with a history of impactful work, innovative proposals for new tools or research, and a clear alignment with the program’s public goods ethos.

The program’s scope was intentionally broad, reflecting the multifaceted nature of blockchain security. Recipients were encouraged to tackle challenges across several key domains:

• Vulnerability Research: Identifying and responsibly disclosing flaws in core Ethereum protocols, smart contracts, and associated infrastructure.
• Security Tooling: Developing open-source tools that enhance auditing, analysis, formal verification, or monitoring capabilities for developers and security professionals.
• Education and Training: Creating resources, workshops, and bootcamps to upskill the global community of security researchers and developers.
• Threat Intelligence: Proactively identifying, analyzing, and disseminating information about emerging threats, attack vectors, and malicious actors.
• Incident Response: Contributing to rapid reaction efforts during active exploits, mitigating damage, and aiding in post-mortem analysis.

This holistic approach was a testament to the understanding that securing a decentralized network demands a decentralized defense, leveraging diverse skill sets and perspectives from across the globe.

Key Contributions: Project Highlights from the ETH Rangers

The six-month program yielded a remarkable array of outcomes, demonstrating the profound impact that targeted support for public goods security can achieve. The 17 stipend recipients delivered crucial advancements across the ecosystem.

SunSec & DeFiHackLabs: Scaling Security Education and Tooling
Under the leadership of SunSec (@1nf0s3cpt) and the vibrant DeFiHackLabs community, the program saw an extraordinary volume of security education and tooling development. This initiative operated as a potent multiplier, transforming a single stipend into educational output that reached hundreds of security researchers globally. DeFiHackLabs’ contributions included:

• Developing and hosting numerous workshops focused on smart contract auditing techniques.
• Publishing in-depth analyses of recent exploits, offering critical lessons for developers.
• Creating a suite of open-source tools to assist in vulnerability discovery and analysis.
• Organizing Capture The Flag (CTF) challenges to hone practical security skills.
  This work is paramount in addressing the talent gap in blockchain security, equipping the next generation of auditors and developers with the knowledge and tools needed to build more secure applications. The sheer scale of community activation here underscores the program’s success in fostering grassroots security initiatives.

Ketman Project: Countering State-Sponsored Infiltration
One recipient spearheaded the expansion of the Ketman Project, a vital initiative focused on identifying and expelling North Korean (DPRK) IT workers who covertly infiltrate blockchain projects. This work directly confronts one of the most sophisticated and pressing operational security threats facing the Ethereum ecosystem today, with state-sponsored actors seeking to exploit vulnerabilities for illicit financial gain. Over the stipend period, the Ketman Project:

• Developed advanced methodologies for identifying suspicious activity patterns and digital footprints linked to DPRK operatives.
• Collaborated with various blockchain projects to facilitate the removal of identified infiltrators.
• Published threat intelligence reports to raise awareness within the wider crypto community about this specific threat vector.
  The project’s work is critical in safeguarding project integrity, protecting user funds, and preventing the illicit financing of hostile state actors, highlighting the program’s reach into geopolitical security concerns.

Nick Bax: Proactive Incident Response and Threat Intelligence
Nick Bax (@bax1337) made significant contributions across multiple fronts, specializing in rapid incident response and proactive threat intelligence. His work was deeply integrated with SEAL 911, the Security Alliance’s rapid response arm. Bax’s efforts included:

• Participating in multiple SEAL 911 incident responses, aiding in the containment and mitigation of active exploits.
• Contributing to DPRK threat mitigation efforts, leveraging intelligence to identify and neutralize potential risks.
• Increasing public awareness through security advisories, best practice guides, and educational content.
  His contributions exemplify the real-time, high-stakes nature of security work, providing critical support when the ecosystem is under attack and helping to disseminate crucial information to prevent future incidents.

Guild Audits: Cultivating Global Security Talent
Guild Audits (@guildaudits) undertook the crucial task of capacity building, running intensive smart contract security bootcamps that are instrumental in training the next generation of Ethereum security researchers. Their focus on historically underrepresented regions, particularly Africa, significantly diversified the talent pool. Over the program duration, Guild Audits:

• Successfully conducted multiple cohorts of smart contract security bootcamps, with high completion rates.
• Mentored aspiring security auditors, guiding them through complex vulnerability analysis.
• Fostered a growing community of skilled security researchers, particularly in emerging markets.
  The capacity-building impact of Guild Audits’ work is profound, creating a pipeline of skilled professionals who will contribute to the long-term security and decentralization of the Ethereum ecosystem.

Palina Tolmach – Kontrol: Advancing Usable Formal Verification
Palina Tolmach (@palinatolmach) of Runtime Verification focused on enhancing Kontrol, a sophisticated formal verification tool for Ethereum smart contracts. Formal verification uses mathematical proofs to guarantee the correctness of code, significantly reducing the risk of critical bugs that traditional testing might miss. Tolmach’s work aimed to make this powerful tool more accessible to a broader range of developers and security researchers. Key Kontrol improvements included:

• Streamlining the user interface and improving documentation to lower the barrier to entry for new users.
• Expanding compatibility with a wider array of smart contract patterns and Solidity versions.
• Implementing clearer error reporting and debugging features.
  All of this work is open source at github.com/runtimeverification/kontrol, directly improving the formal verification tooling landscape for all security researchers and raising the overall quality bar for smart contract development.

Ethereum Execution Client DoS Research: Fortifying Core Infrastructure
A dedicated research team developed an innovative testing framework to systematically evaluate the robustness of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. These attacks, if successful, can severely disrupt network operations by overwhelming nodes. By comprehensively testing all five major execution clients (Geth, Besu, Erigon, Nethermind, and Reth), the team uncovered a staggering 14 bugs across different network protocol layers. These critical vulnerabilities could lead to:

• Client Crashes: Causing nodes to fail, reducing network participation and potentially leading to centralization risks.
• Network Desynchronization: Nodes losing consensus with the rest of the network, leading to inconsistent state.
• Reduced Node Availability: Impairing the ability of nodes to process transactions and propagate blocks.
  The findings underscore that no execution client is entirely immune to sophisticated message-flooding attacks, emphasizing the urgent need for further development of effective countermeasures, such as adaptive rate-limiting mechanisms. The testing framework and detailed results have been shared directly with the Ethereum Foundation’s Protocol Security team, informing crucial future client security research and development priorities.

Further Pillars of Decentralized Defense: Other Stipend Recipients

Beyond these highlighted projects, other ETH Rangers made equally valuable contributions across a diverse range of security-related public goods, demonstrating the program’s broad impact:

• Kelsie Nabben: Authored "Decentralised digital security: community and Inscriptions," a comprehensive book based on 2.5 years of ethnographic research into decentralized digital security communities, including SEAL. This work provides crucial sociological insights into how security is built and maintained in decentralized environments.
• Mothra Team: Built Mothra, a Ghidra extension for EVM bytecode reverse engineering. This powerful open-source tool, including support for EOF decompilation, significantly aids security researchers in analyzing compiled smart contracts for vulnerabilities. They also published detailed technical write-ups on its development.
• SomaXBT (@somaxbt): Published a four-part series on blockchain forensics and the crypto threat landscape. This educational content covered essential topics like fund tracing, attribution techniques, and Open-Source Intelligence (OSINT) methods, empowering the community to better understand and combat illicit activities.
• Peter Kacherginsky: Launched BlockThreat, a dedicated platform for blockchain threat intelligence. BlockThreat systematically analyzes past blockchain security incidents and their root causes, providing valuable historical data and insights for proactive risk management.
• Attack Vectors: Developed attackvectors.org, an open-source, continuously updated guide detailing the top attack vectors in DeFi along with practical prevention strategies. They also contributed significantly to SEAL’s Wallet Security Framework and became a SEAL Steward, deepening their involvement in community security efforts.
• Tim Fan: Developed D2PFuzz, a DevP2P protocol fuzzing framework with differential testing capabilities across multiple execution layer clients. This advanced tool discovered critical bugs through both single-client and cross-client testing, enhancing the robustness of the core Ethereum network.
• nft_dreww (@nft_dreww): Contributed through publishing insightful security articles, hosting educational classes via Boring Security, and conducting audits on various Ethereum public goods projects, thereby fostering both knowledge dissemination and practical security enhancements.
• Jean-Loïc Mugnier: Developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they reach the user’s wallet. This tool, coupled with research into simulation spoofing, significantly enhances user protection against malicious transactions.
• Alexandre Melo: Produced a series of high-quality security workshop videos covering diverse topics such as fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs. These resources are invaluable for developers and researchers seeking to deepen their technical security knowledge.
• Ho Nhut Minh: Enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and a Golang library for seamless integration with the Medusa fuzzer. This advancement significantly speeds up security analysis and vulnerability detection, as demonstrated by benchmarking on Nvidia H100 GPUs.
• Sergio Garcia: Built the Tracelon Monitoring Bot, a Telegram bot offering real-time block monitoring for Ethereum, Bitcoin, and Base, complete with ERC20 balance change alerts. He also continued his crucial contributions to SEAL 911 incident response, showcasing a commitment to both proactive monitoring and reactive defense.

Looking Ahead: The Enduring Impact of Decentralized Defense

The ETH Rangers Program successfully met its objective of supporting individuals undertaking the often "unglamorous but essential" security work vital for Ethereum. The sheer variety and depth of contributions from the 17 stipend recipients powerfully illustrate the expansive nature of "public goods security" in practice. It encompasses far more than merely identifying bugs; it involves the fundamental tasks of building robust tools, educating and training new generations of talent, meticulously documenting crucial knowledge, responding rapidly to active incidents, and continuously enhancing the overall resilience of the ecosystem.

By championing and funding this public goods security work, the program effectively integrated new tools, cutting-edge research, and critical intelligence directly into the broader Ethereum ecosystem. This decentralized approach to defense provides an incomparably stronger foundation for builders, developers, and users worldwide. The ripple effects of these contributions—from improved formal verification tools and enhanced client robustness to a more informed and skilled global security community—will undoubtedly contribute to a safer, more stable, and more trustworthy Ethereum for years to come.

The Ethereum Foundation extends its profound gratitude to all 17 stipend recipients for their invaluable contributions. Special appreciation is also extended to the collaborating organizations: The Red Guild for its hands-on involvement in reviewing submissions, structuring milestones, and providing detailed feedback throughout the process; and Secureum and Security Alliance for their foundational collaboration in establishing and guiding this crucial program. The success of the ETH Rangers Program serves as a compelling model for how a community-driven, decentralized approach can effectively tackle the complex and evolving security challenges of a global blockchain network.