At The Red Guild, we share periodic public updates on what we've done, what we're up to, and what's to come. This helps us stay accountable and committed to our work while we open ourselves to the community.

In case you missed the last one, you can find all our updates here:

updates - The Red Guild
All updates from The Red Guild in a single place.

The menu for today:

ETHRangers

We've been spending lots of our time reviewing your proposals for ETHRangers - a joint effort between the Ethereum Foundation, The Red Guild, and Secureum to incentivize public goods security work in the Ethereum ecosystem.

ETH Rangers
Incentivizing Public Goods Security Work for the Ethereum EcosystemWe offer stipends to support individuals dedicating time to working on public goods security efforts within the Ethereum ecosystem. P
The Network for Onchain Communities

Those who submitted their applications must have heard from us already. Having chosen the most promising ones, we're now following up with their authors to outline more concrete plans for each one. The goal is to achieve the largest impact possible in the security space with this first wave of ETHRangers.

Thanks to all applicants for their time and interest in ETHRangers. For sure, it wasn't easy to pick the most valuable projects. We'll keep you posted on progress!

Overhaul of the Phishing Dojo

At the end of last year, we released the Phishing Dojo:

Announcing the Phishing Dojo: the training ground against phishing and scams in crypto
Interactive challenges to learn how to detect phishing and scams in the crypto space.
The Red Guildtincho

We're glad to see how much the community loved it. It's proven to be an outstanding public good for the crypto community.

After all the feedback we gathered on this first version, we're now onboarding a dedicated developer to The Red Guild that's owning the Phishing Dojo.

For the short term, the goal is to improve usability, add new challenges as well as collect usage metrics. For the mid-to-long-term, we'll make a product out of the Phishing Dojo so that we can cater to those who wish to have an exclusive version for their teams.

SEAL Frameworks

Introduction to the Frameworks - Security Frameworks by SEAL
Logo

We continue leading the SEAL Frameworks initiative. On top of organizing content, discussing future ideas, and gathering community support, we've worked on new practices for the Community Management framework.

In a few weeks, we will do an official launch of the initiative, but in the meanwhile, we will keep working under the GitHub repository and start releasing frameworks while experimenting with the .org and .dev domain.

The Community Management frameworks features recommended practices for Telegram, Discord, X, and Google.

Community Management - Security Frameworks by SEAL
Logo

If you'd like to contribute to this or any other category of SEAL Frameworks, check out the issues in the repository - many are perfect for first-time contributors!

GitHub - security-alliance/frameworks: Official repository for the Security Frameworks by SEAL. Currently under development, not a release.
Official repository for the Security Frameworks by SEAL. Currently under development, not a release. - security-alliance/frameworks
GitHubsecurity-alliance

Beyond the content itself, we're also exploring alternatives to freshen up the look and feel of the Frameworks. Right now, we're using some common mdBook templates. We'd rather have something more unique for it. If you have suggestions, please drop an issue in the repository.

Security Research

VSCode extensions

As we were iterating on a new version of our devcontainer, we got sidetracked by VSCode extensions. How could we easily tell whether the ones we wanted to include in the container were OK?

Chasing down that question, we explored different heuristics to detect malicious VSCode extensions in the public marketplace. Find out our results in the blog post we published 👇

Detecting malicious VSCode extensions - an exploration
Malicious VSCode extensions pose a growing threat to developers, often hiding data exfiltration mechanisms and other dangerous payloads. Join us to learn more about them!
The Red Guildmatta

EIP-7702 accounts

With EIP-7702 rolling out soon to Ethereum's mainnet, we felt like joining the party. The goal, as always, was to understand and raise awareness about the security risks involved for users and developers. That almost nobody is talking about.

The result? A +1 hour video breaking down the whole thing for you. We want you to learn Ethereum 7702 accounts the right way. Security threats, footguns, risks, real testing, and ideas to build safer programmable accounts.

Find the video in our latest blog post and X announcement 👇

Deep Dive into Ethereum 7702 Smart Accounts: security risks, footguns and testing
Learn Ethereum 7702 accounts the right way. Security threats, footguns, risks, real testing, and ideas to build safer programmable accounts.
The Red Guildtincho

Devcontainers

Following up on our initial work on devcontainers for web3 developers and security researchers, we spent some time revamping the devcontainer setup to reduce its attack surface.

Along with releasing the new version in our public GitHub repository, we published a blog post explaining the new hardening configuration step-by-step, setup of the Dockerfile and devcontainer.json files.

Where do you run your code? part II - devcontainer security
Achieving isolation can be a complicated issue. Learn about how you can improve your environment security with this post.
The Red Guildmatta

You'll learn how we:

  • Install as few packages as possible
  • Use the principle of the least privilege
  • Use efficient and isolated package managers
  • Set pre-built binaries
  • Isolate your host from the container

And more protections for mount isolation, filesystem configs, multi-stage builds, etc.

In the meantime, more people are spreading the container ethos in the web3 space! Although not authored by us, here's an outstanding piece of content by @PatrickAlphaC sharing his view and approach to containers:

Remedy CTF

During January we participated in the Remedy CTF. Wouldn't say competed, because we only had time to play one challenge.

Still, it was an interesting learning experience. We published our writeup of the Diamond Heist challenge 👇

Remedy CTF: Diamond Heist writeup
Writeup for the Diamond Heist challenge of the Remedy CTF.
The Red Guildtincho

Talks and workshops at ETHCC

ETHCC is happening in some months. Although the location isn't exactly what we'd hoped for, we might attend if we land a few talks and workshops there.

EthCC[8] — June 30th to July 3rd 2025
Ethereum Community Conference & Workshops: June 30th to July 3rd, 2025 in Cannes
EthCC[8]

For now we've already submitted a talk on SEAL Frameworks and a security-oriented workshop to share the latest updates on our Phishing Dojo.

What's next

Here are a few things happening at The Red Guild in the upcoming weeks:

  • Preparing for Aleph Buenos Aires! We're not only attending but also participating in many of the planned activities and likely contributing with fresh content to continue strengthening our dear LATAM community.
Aleph March ’25
The Crecimiento Pop-Up City is a moment-in-time for these visionaries to come together with renowned experts, and transform Argentina into a world-leading startup & innovation hub.
  • Advancing ETHRangers proposals, as we continue to detail projects better.
  • Further developing the Phishing Dojo. Heavy development and rework to be happening behind the scenes. Particularly on backend stuff. It should result in an overall better experience for all players.
  • Improving design and visuals of all public assets. During February, we're starting to work with an awesome designer who will bring fresh magic to The Red Guild 🎨 🪷

And remember folks, always follow Patrick's advice 👇

See you on the next one! 👋