---

Today, we disclosed the first set of vulnerabilities from the Ethereum Foundation’s Bug Bounty Programs. These vulnerabilities were previously discovered and reported directly to the Ethereum Foundation or client teams via the Bug Bounty Programs for both the Execution Layer and Consensus Layer.

Through its Bug Bounty Programs, which allow the Ethereum Foundation (EF) to coordinate and cross-check vulnerabilities across clients, the EF currently accepts vulnerability reports for Nimbus, Teku, Lighthouse, Prysm, Lodestar, Go Ethereum, Nethermind, Erigon and Besu.

New repository & vulnerability list

The full list of vulnerabilities, along with additional information, can be found in a git repository here.

The new disclosures repository catalogues all known vulnerabilities that were patched prior to the latest hardforks on the Execution Layer and Consensus Layer.

We would like to give a massive shout out to everyone involved in the discovery and reporting of vulnerabilities, as well as to the teams responsible for fixing them. While we have attempted to include the names or aliases of the reporters, there are many developers and researchers within the client teams and in the Ethereum Foundation who found and corrected vulnerabilities outside of the bounty program. There are also many unsung heroes such as client team developers, community members, and many more who have spent countless hours triaging, cross-checking, and mitigating vulnerabilities before they could be exploited.

For more information, and to learn more about disclosure policies, timelines, and cataloging, head over to the new disclosures repository.

Your immense efforts have been instrumental to ensuring Ethereum’s security. Thank you!

The Securities and Exchange Commission has concluded its multi-year review of Coinbase’s financial disclosures without requiring any amendments or restatements, according to a letter released by the agency and shared by the exchange’s Chief Legal Officer Paul Grewal.

In an April 15 social media post, Grewal highlighted that the resolution comes after more than two years of engagement with the SEC’s Division of Corporation Finance.

He wrote:

“We’ve fully resolved – without restatements or amendments – a number of comments related to our disclosures.”

He added that Coinbase remains focused on “bringing the next billion onchain and building world-class products.”

SEC letter

The letter, dated March 17, was addressed to Coinbase Chief Financial Officer Alesia Haas. It confirmed that the SEC had completed its review of the company’s Form 10-K filings for the fiscal years ending December 31, 2022, and 2023.

The letter stated:

“We remind you that the company and its management are responsible for the accuracy and adequacy of their disclosures.”

The regulator further emphasized that the completion of the review does not constitute a sign-off or endorsement of the filings.

The conclusion of the review marks the end of a prolonged comment process that began shortly after Coinbase went public in April 2021. The company’s operations and disclosures have remained under regulatory scrutiny amid evolving standards for digital asset companies navigating US securities law.

It also comes after the regulatory landscape has shifted dramatically since President Donald Trump returned to office in January. His administration has signaled a departure from the aggressive enforcement-led approach championed by former SEC Chair Gary Gensler under the previous administration.

The regulator has already dismissed several lawsuits against crypto firms, including its legal action against Coinbase, and is actively working on developing a regulatory framework for the industry under its new leadership.

Mentioned in this article

Today, we have disclosed the second set of vulnerabilities from the Ethereum Foundation Bug Bounty Program! These vulnerabilities were previously discovered and reported directly to the Ethereum Foundation.

When bugs are reported and validated, the Ethereum Foundation coordinates disclosures to affected teams and helps cross-check vulnerabilities across all clients. The Bug Bounty Program currently accepts reports for the following client software:

• Erigon
• Go Ethereum
• Lodestar
• Nethermind
• Lighthouse
• Prysm
• Teku
• Besu
• Nimbus

In addition to client software, the Bug Bounty Program also covers the Deposit Contract, Execution Layer & Consensus Layer Specifications and Solidity.

Repository & vulnerability list

Since the last vulnerability disclosure has been quite eventful with events such as the Merge and the max bounty reward increase to $250,000.

The highest paid reward during this period was $50,000. This was awarded to scio for reporting an issue in which Lighthouse beacon nodes crashed via malicious BlocksByRange messages containing an overly large count value. You can read more about this specific vulnerability here.

Another notable set of vulnerabilites has been around fork choice attacks. EF researchers and client teams investigated and patched attacks that were able to cause long reorgs.

Guido Vranken holds the top spot most positive reports in this period. At the same time, Guido managed to collect the most points for the Bug Bounty Leaderboard!

We also have two bounty hunters who decided to donate their rewards to charities: nrv and PwningEth!

The full list of new vulnerabilities, along with full details, can be found in the disclosures repository.

All vulnerabilities added to the disclosures catalogue were patched prior to the latest hardforks on the Execution Layer and Consensus Layer.

For more information, and to learn more about disclosure policies, timelines, and cataloging, head over to the disclosures repository.

Thank you

We would like to give a massive shout out to everyone involved in the discovery and reporting of vulnerabilities, as well as to the teams responsible for fixing them. While we have attempted to include the names or aliases of all reporters, there are many developers and researchers within the client teams and in the Ethereum Foundation who found and corrected vulnerabilities outside of the bounty program. There are also many unsung heroes such as client team developers, community members, and many more who have spent countless hours triaging, cross-checking, and mitigating vulnerabilities before they could be exploited.

Your immense efforts have been instrumental to ensuring Ethereum’s security. Thank you!