{"id":18105,"date":"2026-03-09T10:33:56","date_gmt":"2026-03-09T10:33:56","guid":{"rendered":"https:\/\/cryptoted.net\/index.php\/2026\/03\/09\/secured-no-1-ethereum-foundation-blog\/"},"modified":"2026-03-09T10:33:56","modified_gmt":"2026-03-09T10:33:56","slug":"secured-no-1-ethereum-foundation-blog","status":"publish","type":"post","link":"https:\/\/cryptoted.net\/index.php\/2026\/03\/09\/secured-no-1-ethereum-foundation-blog\/","title":{"rendered":"Secured no. 1 | Ethereum Foundation Blog"},"content":{"rendered":"


\n<\/p>\n

\n

Earlier this year, we launched a bug bounty program<\/a> focused on finding issues in the beacon chain specification, and\/or in client implementations (Lighthouse, Nimbus, Teku, Prysm etc…). The results (and vulnerability reports) have been enlightening as have the lessons learned while patching potential issues.<\/p>\n

In this new series, we aim to explore and share some of the insight we’ve gained from security work to date and as we move forward.<\/p>\n

This first post will analyze some of the submissions specifically targeting BLS primitives.<\/p>\n

Disclaimer<\/strong>: All bugs mentioned in this post have been already fixed.<\/p>\n

<\/g><\/svg><\/a>BLS is everywhere<\/h2>\n

\"\"<\/p>\n

A few years ago, Diego F. Aranha <\/a> gave a talk at the 21st Workshop on Elliptic Curve Cryptography<\/a> with the title: Pairings are not dead, just resting.<\/em> How prophetic.<\/p>\n

Here we are in 2021, and pairings are one of the primary actors behind many of the cryptographic primitives used in the blockchain space (and beyond): BLS<\/a> aggregate signatures, ZK-SNARKS systems, etc.<\/p>\n

Development and standardization work related to BLS signatures has been an ongoing project for EF researchers for a while now, driven in-part by Justin Drake<\/a> and summarized in a recent post of his on reddit<\/a>.<\/p>\n

<\/g><\/svg><\/a>The latest and greatest<\/h2>\n

In the meantime, there have been plenty of updates. BLS12-381<\/a> is now universally recognized as the pairing curve<\/strong> to be used given our present knowledge<\/em>.<\/p>\n

Three different IRTF drafts are currently under development:<\/p>\n

    \n
  1. Pairing-Friendly Curves<\/a><\/li>\n
  2. BLS signatures<\/a><\/li>\n
  3. Hashing to Elliptic Curves<\/a><\/li>\n<\/ol>\n

    Moreover, the beacon chain specification<\/a> has matured and is already partially deployed. As mentioned above, BLS signatures<\/a> are an important piece of the puzzle behind proof-of-stake (PoS) and the beacon chain.<\/p>\n

    <\/g><\/svg><\/a>Recent lessons learned<\/h2>\n

    After collecting submissions targeting the BLS primitives used in the consensus-layer, we’re able to split reported bugs into three areas:<\/p>\n