Layla Zulfa
In late 2024, the Ethereum Foundation, in a strategic collaboration with leading security entities Secureum, The Red Guild, and Security Alliance (SEAL), embarked on a crucial initiative: the ETH Rangers Program. This groundbreaking endeavor was conceived to provide essential stipends to individuals dedicating their expertise to public goods security work within the expansive Ethereum ecosystem. After an intensive six-month period, the program has successfully concluded, unveiling a compelling portfolio of achievements from its 17 stipend recipients, underscoring the indispensable role of decentralized defense in safeguarding the world’s leading smart contract platform.
The imperative for such a program stems from the inherent nature of decentralized networks like Ethereum. As a global, open-source blockchain supporting a multi-trillion-dollar digital economy encompassing DeFi, NFTs, and countless decentralized applications, its security is paramount. Unlike traditional centralized systems with clear perimeters and dedicated security departments, Ethereum’s resilience relies on a collective, often uncompensated, effort from a vast community of developers, researchers, and white-hat hackers. Public goods security, in this context, refers to critical work that benefits the entire ecosystem but often lacks a direct, immediate profit motive, making it challenging to fund through conventional market mechanisms. This includes vulnerability research, tool development, security education, threat intelligence, and incident response. The increasing sophistication of cyber threats, ranging from individual exploits to state-sponsored attacks, further amplifies the need for robust, proactive, and distributed security measures. The ETH Rangers Program was thus a direct response to this evolving threat landscape, aiming to formalize and incentivize these vital contributions.
The program’s goal was elegantly straightforward: to identify and fund independent efforts that demonstrably enhance the resilience of the Ethereum ecosystem and to recognize individuals with proven track records of making meaningful contributions to security work that benefits Ethereum as a whole. This stipend model offered a flexible and impactful way to support security researchers and practitioners, allowing them to focus on critical, often unglamorous, tasks without immediate commercial pressures. The collaboration with Secureum, known for its expertise in security education and audits; The Red Guild, specializing in community building and security research coordination; and Security Alliance (SEAL), a vital hub for incident response and threat intelligence, ensured a comprehensive and well-supported framework for the Rangers.
The breadth and depth of the output from the 17 stipend recipients are nothing short of impressive, showcasing the diverse facets of public goods security. Their contributions spanned a wide array of disciplines, from foundational vulnerability research and the development of cutting-edge security tooling to essential education initiatives, proactive threat intelligence gathering, and rapid incident response. This decentralized approach to defense has woven new layers of protection into the fabric of the Ethereum network, reinforcing its foundation against an ever-present array of threats. The program’s outcomes stand as a testament to the reality that securing a decentralized network truly necessitates a decentralized defense, leveraging the collective intelligence and dedication of its global community.
Project Highlights: A Deep Dive into Impact
Several projects exemplify the profound impact of the ETH Rangers Program:
SunSec & DeFiHackLabs: Amplifying Security Education and Tooling
SunSec, in partnership with the thriving DeFiHackLabs community, delivered an extraordinary volume of security education and tooling work. Over the six-month stipend period, DeFiHackLabs organized numerous workshops, potentially reaching hundreds of aspiring and established security researchers with in-depth training on smart contract vulnerabilities, secure coding practices, and advanced auditing techniques. They developed and open-sourced critical security tools, which could include static analyzers, fuzzers, or exploit development frameworks, significantly lowering the barrier to entry for security research and enhancing the overall defensive capabilities of the ecosystem. The sheer scale of community activation achieved by DeFiHackLabs is particularly notable. By turning a single stipend into educational output and practical tools that reached hundreds, if not thousands, of security researchers, SunSec and DeFiHackLabs acted as a powerful multiplier. This initiative addressed a critical need for continuous education in a rapidly evolving technological landscape, ensuring a steady pipeline of skilled security professionals capable of identifying and mitigating risks.
Ketman Project – DPRK IT Worker Investigations: Countering State-Sponsored Threats
One of the program’s most critical contributions came from a recipient who built and scaled the Ketman Project, an initiative specifically focused on discovering and expelling North Korean (DPRK) IT workers who have infiltrated blockchain projects under fake identities. Over the stipend period, the project achieved significant milestones, potentially identifying dozens of individuals attempting to compromise sensitive projects, developing advanced attribution techniques to unmask these actors, and collaborating with law enforcement and intelligence agencies to share critical threat intelligence. This work directly addresses one of the most pressing operational security threats facing the Ethereum ecosystem today. North Korean state-sponsored hacking groups are notorious for their sophisticated methods and persistent efforts to illicitly acquire funds from the crypto industry to circumvent international sanctions. By proactively identifying and neutralizing these infiltrations, the Ketman Project safeguards vital development teams, prevents potential supply chain attacks, and protects vast amounts of digital assets, thereby enhancing the overall integrity and trustworthiness of the ecosystem.
Nick Bax – Incident Response and Threat Intelligence: On the Front Lines
Nick Bax made substantial contributions across multiple critical fronts, primarily through active participation in SEAL 911 incident response, direct DPRK threat mitigation, and public awareness campaigns. His work likely involved rapid analysis of ongoing exploits, coordination with affected projects, and dissemination of crucial information to prevent further damage. In the fast-paced world of blockchain, immediate and effective incident response can be the difference between a minor setback and a catastrophic loss of funds. Bax’s efforts in DPRK threat mitigation likely included identifying suspicious activities, tracking malicious addresses, and sharing intelligence to pre-empt attacks. Furthermore, his public awareness contributions, possibly through alerts, articles, or presentations, armed the community with knowledge about emerging threats and best security practices, fostering a more vigilant and resilient user base.
Guild Audits – Security Education in Africa and Beyond: Building Global Capacity
Guild Audits ran intensive smart contract security bootcamps, playing a pivotal role in training the next generation of Ethereum security researchers. Over the stipend period, they successfully executed multiple bootcamps, potentially training over 100 individuals across various cohorts. These programs focused on practical skills, covering Solidity auditing, common vulnerability patterns, and the use of advanced security tools. A significant aspect of their work was targeting regions historically underrepresented in the global tech and blockchain security communities, particularly in Africa. The capacity-building impact of Guild Audits’ smart contract security bootcamps is immense, creating a vital pipeline of skilled security researchers. This not only diversifies the talent pool but also strengthens the global defensive posture of Ethereum, ensuring that security expertise is not concentrated in a few geographic hubs.
Palina Tolmach – Kontrol: Usable Formal Verification: Enhancing Rigor
Palina Tolmach of Runtime Verification dedicated her efforts to improving Kontrol, a cutting-edge formal verification tool designed for Ethereum smart contracts. Formal verification is a highly rigorous method of proving the correctness of code, essential for high-value and mission-critical smart contracts. Tolmach’s work focused on making Kontrol more accessible and user-friendly for a wider audience of developers and security researchers. Key improvements likely included enhanced documentation, intuitive user interfaces, integration with popular development environments, and the addition of new features that simplify the process of specifying and verifying contract properties. All of this work is open source at github.com/runtimeverification/kontrol, significantly improving the formal verification tooling landscape for all security researchers. By making such powerful tools more approachable, Tolmach is enabling more projects to achieve higher levels of security assurance, reducing the likelihood of complex logical bugs that often lead to devastating exploits.
Ethereum Execution Client DoS Research: Fortifying Core Infrastructure
A dedicated research team developed a robust testing framework to systematically evaluate the robustness of Ethereum execution clients under message-flooding denial-of-service (DoS) attacks. This research is foundational to the stability and resilience of the entire Ethereum network, as execution clients (like Geth, Besu, Erigon, Nethermind, and Reth) are the software implementations that process transactions and maintain the state of the blockchain. By subjecting all five major execution clients to rigorous testing, the team unearthed a significant discovery: 14 bugs across different network protocol layers. These vulnerabilities, which could lead to critical issues such as node crashes, transaction processing delays, or complete network partitions, highlight that no execution client is completely immune to message-flooding attacks. The findings were shared with the Ethereum Foundation’s Protocol Security team, directly informing ongoing client security research and emphasizing the urgent need for effective countermeasures, such as adaptive rate-limiting mechanisms, to prevent potential network disruptions.
The Wider Cohort: Diverse Contributions to Ethereum’s Defense
Beyond these prominent examples, the remaining stipend recipients contributed across an equally wide and vital range of security-related public goods, each adding a unique layer to Ethereum’s decentralized defense:
- Kelsie Nabben authored a comprehensive book based on 2.5 years of ethnographic research into decentralized digital security communities, including SEAL. This work provides invaluable insights into the social and organizational dynamics of security in decentralized environments, offering a deeper understanding of how these communities function and can be better supported.
- The Mothra team built Mothra, a Ghidra extension for EVM bytecode reverse engineering, complete with support for EOF (EVM Object Format) decompilation. They also published detailed technical write-ups on its development, providing a critical tool for analyzing compiled smart contracts and identifying vulnerabilities at a low level.
- SomaXBT published a four-part series on blockchain forensics and the crypto threat landscape, covering advanced techniques for fund tracing, attribution, and Open-Source Intelligence (OSINT) methods. This educational content equips the community with essential skills for investigating incidents and understanding attacker methodologies.
- Peter Kacherginsky launched BlockThreat, a platform for blockchain threat intelligence that systematically analyzes past security incidents and their root causes. This resource is crucial for learning from historical exploits and developing proactive defense strategies.
- Attack Vectors developed attackvectors.org, an open-source, continuously updated guide covering the top attack vectors in DeFi along with recommended prevention strategies. They also contributed to SEAL’s Wallet Security Framework and became a SEAL Steward, showcasing their commitment to practical security resources and community involvement.
- Tim Fan developed D2PFuzz, a DevP2P protocol fuzzing framework with differential testing capabilities across multiple execution layer clients. This advanced tool found bugs through both single-client and cross-client testing, significantly bolstering the robustness of the core Ethereum network protocols.
- nft_dreww published impactful security articles, hosted educational classes through Boring Security, and conducted audits on various Ethereum public goods projects. Their multi-faceted approach combined education with direct security contributions.
- Jean-Loïc Mugnier created a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they reach the wallet. This user-facing tool, coupled with his simulation spoofing research, offers a vital layer of protection against malicious transaction signing.
- Alexandre Melo produced a series of security workshop videos covering diverse topics such as fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs. These resources expand the collective knowledge base and skill sets of security practitioners across different blockchain domains.
- Ho Nhut Minh enhanced CuEVM, a GPU-accelerated EVM implementation, with multi-GPU support and a Golang library for integration with the Medusa fuzzer. Benchmarked on Nvidia H100 GPUs, this work significantly boosts the performance of security analysis tools, enabling faster and more comprehensive audits.
- Sergio Garcia built the Tracelon Monitoring Bot, a Telegram bot offering real-time block monitoring on Ethereum, Bitcoin, and Base, complete with ERC20 balance change alerts. He also continued his contributions to SEAL 911 incident response, providing essential tools for early detection and rapid reaction to suspicious activities.
Statements from Organizers and Participants
"The success of the ETH Rangers Program vividly demonstrates the power of a decentralized community in upholding the security of a global network," remarked a spokesperson from the Ethereum Foundation. "The dedication and ingenuity displayed by these 17 recipients have integrated critical new tools, research, and intelligence into our ecosystem. This program has not only identified and mitigated immediate threats but has also laid groundwork for long-term resilience, proving that investing in public goods security is an investment in the future of Ethereum itself."
A representative from The Red Guild expressed deep satisfaction with the program’s operational success. "Our hands-on involvement in reviewing submissions, structuring milestones, and providing detailed feedback allowed us to directly witness the incredible impact these individuals had. The collaborative spirit among the Rangers, coupled with their relentless pursuit of security excellence, has been truly inspiring. We are immensely proud to have facilitated such a crucial initiative."
"Receiving the stipend through the ETH Rangers Program was a game-changer for the Ketman Project," shared a recipient from the DPRK IT Worker Investigations initiative. "It provided the dedicated resources needed to scale our operations, allowing us to delve deeper into attribution techniques and share vital intelligence more effectively. This support directly translates into a safer ecosystem for everyone, protecting projects from state-level adversaries who pose a significant and often underestimated threat."
Strategic Implications and the Future of Decentralized Security
The ETH Rangers Program has unequivocally affirmed that securing a decentralized network requires a decentralized defense. Its strategic implications are far-reaching, setting a precedent for how public goods security can be effectively funded and coordinated within open, permissionless ecosystems.
Firstly, the program has fostered significant innovation in security tooling and research. By empowering independent researchers, it has led to the development of novel testing frameworks, reverse engineering tools, and formal verification enhancements that might not have emerged through traditional grant or bounty programs. These open-source contributions will continue to benefit the entire community for years to come.
Secondly, the emphasis on capacity building and education, particularly in underserved regions, addresses a fundamental long-term challenge. By training new cohorts of security researchers, the program helps democratize access to high-demand skills and builds a more diverse and globally distributed security talent pool, strengthening Ethereum’s defensive capabilities from the ground up.
Thirdly, the focus on threat intelligence and incident response has demonstrably improved the ecosystem’s ability to anticipate, detect, and react to threats. From identifying state-sponsored actors to developing real-time monitoring bots, the Rangers have enhanced the collective early warning systems and rapid response mechanisms.
Finally, the program serves as a powerful model for community empowerment. It validates the critical contributions of independent individuals and smaller teams, demonstrating that meaningful security advancements can come from anywhere in the world. This approach contrasts with relying solely on large auditing firms or internal security teams, promoting a more resilient, distributed, and adaptive security posture. The stipend model, distinct from traditional grants or bug bounties, allowed for sustained, focused work on foundational security problems that might not fit neatly into other funding categories.
As the Ethereum ecosystem continues to grow in complexity and value, the need for proactive and diverse security efforts will only intensify. The ETH Rangers Program has not only delivered tangible results but has also provided invaluable lessons and a blueprint for future initiatives. Its legacy will undoubtedly be seen in the enhanced security infrastructure, the expanded talent pool, and the strengthened collaborative spirit that now underpins the resilience of the Ethereum network.
The Ethereum Foundation, Secureum, The Red Guild, and Security Alliance (SEAL) are deeply grateful to all 17 stipend recipients for their exceptional contributions. Special acknowledgment goes to The Red Guild for their hands-on involvement, rigorous review of submissions, diligent structuring of milestones, and invaluable detailed feedback throughout the program. The collaboration of all partners was instrumental in establishing and successfully executing this vital program, creating a stronger and safer foundation for builders and users worldwide.
