Securing Ethereum at the protocol layer.
I'm Antoine James — a security researcher at the Ethereum Foundation, where I lead the Bug Bounty Program efforts and hunt vulnerabilities in the clients and specifications that run the network.
Findings
Responsibly disclosed vulnerabilities across Ethereum execution clients, consensus clients, and protocol specifications.
Critical
Chess.com
Payment System BypassUnauthorized premium subscription access via a payment-flow flaw.
Low
Reth
EIP-2681 Nonce ValidationMissing nonce validation lets invalid transactions enter the pool.
Medium
Besu
P256 Curve Point ValidationMissing on-curve validation in P256Verify causes block import failures.
Low
Geth
EIP-2935 Constant MismatchVerkle testing constant doesn't match the hardcoded 0x1FFF bytecode value.
Low
Reth
Missing Malicious Peer PunishmentNo penalty for peers spamming unwanted transaction hashes.
High
go-libp2p-pubsub
Remote DoSAffects all protocols built on it — Prysm, Optimism, Filecoin, and more.
High
Prysm
HTR Transaction BombMax-transaction blocks are hashed before the slot check, OOM-killing the node.
High
Consensus Specs
Frozen Builder WithdrawalsRepeated 1 ETH deposits lock a builder's withdrawable balance.
Low
Lighthouse
Unsorted Data Columns in KZGColumns not sorted before KZG, breaking cell-index ordering.
Info
Consensus Specs
Fulu DAS Parameter OrderingSwapped parameter order in the DAS index functions.
Low
Lighthouse
Memory Leak in Column SidecarsMissing cache pruning leaks ~7MB/day on long-running beacon nodes.
AI System Findings
Found by my KAT tool, an AI system that front-runs bug bounty submissions.
Experience
Selected as one of the 200 Top Security Minds of Ethereum, helping allocate 75,000 ETH to strengthen Ethereum security.
Auditing EIPs, consensus and execution specs, and all 11 clients in their own languages, with manual review, fuzzing and AI tooling. Leading the Bug Bounty Program end to end, from reviews to payouts. Rebuilt the submission process from the ground up: new UI, submission fee, AI triage.
Backend work on Cantina, Spearbit's competitive audit platform — built profile features like auditors' findings display, optimized and fixed SQL queries, and shipped API and data-layer improvements in Rust.
Formal verification of the Sui blockchain type-checker and Keccak implementation — translating Rust code to Coq proofs for critical blockchain components.
Talks & Writing
Ethereum Bug Bounty 2026: A Retrospective
Blog postAI in Protocol Security at the Ethereum Foundation
ETHSofia 2025Ethereum Protocol Security 101
DeFi Security Summit 2025Contests
Findings from competitive audit platforms.
I only took part in one contest on Cantina and two on Code4rena before a non-compete put competitive auditing on hold — most of my work now happens at the Ethereum Foundation.
Let's talk security
Open to protocol security research, audits, and collaboration.