Securing Ethereum at the protocol layer.
I'm Antoine James — a security researcher at the Ethereum Foundation, where I lead the Bug Bounty Program efforts and hunt vulnerabilities in the clients and specifications that run the network.
Findings
Responsibly disclosed vulnerabilities across Ethereum execution clients, consensus clients, and protocol specifications.
My own findings, not Bug Bounty submissions.
Client severity, not bounty severity. Scope and network share change the rating.
Critical
Chess.com
Payment System BypassUnauthorized premium subscription access via a payment-flow flaw.
High
Prysm
HTR Transaction BombMax-tx blocks are hashed before the slot check, OOM-killing the node.
High
Consensus Specs
Frozen Builder WithdrawalsRepeated 1 ETH deposits lock a builder's withdrawable balance.
Low
Lighthouse
Unsorted Data Columns in KZGColumns not sorted before KZG, breaking cell-index ordering.
Info
Consensus Specs
Fulu DAS Parameter OrderingSwapped parameter order in the DAS index functions.
Low
Lighthouse
Memory Leak in Column SidecarsMissing cache pruning leaks ~7MB/day on long-running beacon nodes.
Embargoed
13 pending disclosure
Ethereum clients and librariesAI System Findings
Found by my KAT tool, an AI system that front-runs bug bounty submissions.
Found by my KAT tool, not Bug Bounty submissions.
Client severity, not bounty severity. Scope and network share change the rating.
Low
rust-libp2p
StrictNoSign DeviationA forbidden gossip key field is relayed instead of being rejected.
Low
Teku
StrictNoSign DeviationTeku relays a forbidden gossip field; peers score it down and drop it.
Low
Nethermind
Snap Lookup DoSEmpty-path snap lookups go uncounted, so one request stalls the node.
Low
Lodestar
Validator Slashing RiskA slot-mismatch races the double-proposal check and gets a key slashed.
Info
Nethermind
EIP-7702 ScopingTxpool logs foreign-chain 7702 authorities, blocking their own next txs.
High
Ethrex
Network-wide MODEXP DoSOne tx makes MODEXP copy its whole args region, stalling block import.
Info
Lighthouse
Fork Choice GapAfter a crash, fork choice refuses valid canonical blocks as conflicts.
Embargoed
31 pending disclosure
Ethereum clients and librariesExperience
Selected as one of the 200 Top Security Minds of Ethereum, helping allocate 75,000 ETH to strengthen Ethereum security.
Auditing EIPs, consensus and execution specs, and all 11 clients in their own languages, with manual review, fuzzing and AI tooling. Leading the Bug Bounty Program end to end, from reviews to payouts. Rebuilt the submission process from the ground up: new UI, submission fee, AI triage.
Backend work on Cantina, Spearbit's competitive audit platform — built profile features like auditors' findings display, optimized and fixed SQL queries, and shipped API and data-layer improvements in Rust.
Formal verification of the Sui blockchain type-checker and Keccak implementation — translating Rust code to Coq proofs for critical blockchain components.
Talks & Writing
Ethereum Bug Bounty 2026: A Retrospective
Blog postAI in Protocol Security at the Ethereum Foundation
ETHSofia 2025Ethereum Protocol Security 101
DeFi Security Summit 2025Contests
Findings from competitive audit platforms.
I only took part in one contest on Cantina and two on Code4rena before a non-compete put competitive auditing on hold — most of my work now happens at the Ethereum Foundation.
Let's talk security
Open to protocol security research, audits, and collaboration.