lead-thedao-fund.html version record.

+ TheDAO Security Fund | Initiatives TheDAO Security Fund Initiatives Suggest an initiative Connect wallet Ecosystem-funded security initiatives $ 247,852 raised for Ethereum security initiatives Security initiatives looking for funding Show top matches + Suggest an initiative Know something the ecosystem should fund? Pitch it. Grant Source-Level Debugging for Solidity: ethdebug in solc solc does not emit the debug information debuggers need, so every tool reverse-engineers compiler behavior and breaks when the compiler changes. This funds implementing the ethdebug format directly in solc, with debug data that survives the full optimizer pipeline so it works on production builds. $151,008 of $279,000 · 3 backers 54.1% Donate Details Pledged by Grant End-to-End Formally Verified Vyper Compiler This grant funds a machine-checked proof that Vyper compilation preserves the meaning of source programs, plus the infrastructure to re-verify supported releases. It brings abstract methods, unbounded dynamic arrays and storage packing into the verified pipeline. The intended result is a public verified compilation mode, available through the official compiler as `--verified`, with documented guarantees and production adoption. $100,025 of $600,000 · 4 backers 16.7% Donate Details Pledged by RFP Wallet Security for Post-Quantum Ethereum Post-quantum Ethereum needs wallet support and signer safety alongside protocol upgrades. This RFP funds independent security-proof research, a shared signer safety profile, and public signer and verifier tests. It covers hardware and browser compatibility, frame transactions, scalability, hash functions, and builder and user guidance on signature budgets. Adoption requires public tests, conformance statements, and support from wallet suppliers. $553.70 of $250,000 · 3 backers 0.2% Donate Details Grant LeekWallet: an open DIY hardware wallet with a secure element PIN gate, and build workshops in Mexico LeekWallet is an open source hardware wallet anyone can build from about $30 of parts bought from any seller, whose device decodes every transaction itself and refuses what it cannot display. This grant adds an ATECC608B secure element that keeps the PIN attempt counter in silicon the main chip cannot rewrite, closing the project's largest open weakness. It then puts at least 80 working devices in builders' hands through one in-person workshop in Mexico City and one online workshop, with build guides in English and Spanish for first-time and experienced solderers. $87.15 of $32,190 · 2 backers 0.3% Donate Details Grant thatsRekt: EVM exploit alerts for the public good. thatsRekt aggregates and reads trusted security accounts on X, uses AI to work out which posts are actually about a live exploit, and turns the good ones into structured, on-chain alerts that anyone can read for free. This grant pays for a better AI/ML detection pipeline, build an open API and automated X posting so the feed actually reaches third party integrators and other tools, plus two more guardian teams running their own detectors so the network isn't dependent on one team. $4.99 of $45,000 · 1 backer 0.0% Donate Details Grant Decentralized, Privacy-Preserving EDR Endpoint Detection and Response is one of the highest-value security controls a team can run, and almost nobody in crypto runs it, because mainstream EDR sits in your kernel and streams telemetry to a central vendor. This grant funds an EDR crypto teams will actually adopt, user-space, self-hostable, privacy-preserving by construction, tuned for Web3 threats. Auditware is the recipient. $1.29 of $300,000 · 1 backer 0.0% Donate Details Grant Towards a Formally Verified Solc Solc compiles the overwhelming majority of contracts deployed on Ethereum as well as its rollups and underpins [99% of Ethereum’s value](https://www.growthepie.com/quick-bites/compiler-tvs) on-chain which makes security the highest priority. A correctness defect in the compiler itself can silently undermine every audit performed on the source code it processes.

+ The Solidity team is working towards a formally verified compiler with two focused and clearly bounded projects to verify key parts of the solc compilation chain:

+ 1. Formalization + Agent Based Optimization Harness for the Solc Stack Shuffler

+ 2. Formalization of the semantics of Core Solidity

+ Both of the projects are of independent interest as standalone projects, but they would also be key building blocks in any future effort to produce a full end to end verification chain for solc. $0 of $350,000 0.0% Donate Details Grant Safe Lockdown Guard: An Emergency Freeze for Kidnapping and Coercion Kidnapping and physical coercion can force Safe owners to authorize transfers with perfectly valid signatures. Safe Lockdown Guard gives them a separate emergency action: freeze guarded transfers with a credential that cannot spend funds. Runtime Capital has built and published the open-source audit candidate; this $14,000 request funds the remaining independent audit cost, with a final milestone tied to verified use on Ethereum mainnet. The audit, fixes and installation documentation will be public for every compatible Safe operator. $0 of $14,000 0.0% Donate Details Grant DPRK IT Worker Screening for the Ethereum Ecosystem NorthScan will provide approved Ethereum organizations with a controlled service for screening GitHub profiles for behavioral, identity and network signals associated with DPRK IT worker activity. The six-month pilot will combine automated assessments with selected human review, practical integration resources and measurable adoption across the ecosystem. The grant will also validate a sustainable freemium and paid-access model for trusted organizations. $0 of $50,000 0.0% Donate Details Grant NanoJS Investigations: Sustaining Independent Ethereum Forensic Casework and Open Tooling NanoJS Investigations funds continued independent forensic investigation into Ethereum exploits, alongside NanoJS Pipeline, an open-source toolkit for sanctions screening, wallet clustering, and contract discovery. Nine investigations published to date have led to confirmed exchange freezes and law-enforcement filings. This grant sustains casework already in progress and opens the pipeline for other investigators to use. $0 of $10,000 0.0% Donate Details Grant Self-serve scoped permissions and pre-signature checks for Safes and AI agents Self-custody fails at the moment of signing. This grant builds a self-serve app that turns on audited Zodiac controls with safe defaults, adds the pre-signature checks that do not exist yet, and scopes an AI agent so it holds no key. Apache 2.0 throughout. The largest milestone pays only when 100 Safes outside Protocol Wealth run it holding at least $20,000,000, verifiable onchain. $0 of $135,000 0.0% Donate Details Grant Onchain Risk Map: An Open Operational Incident Graph for Ethereum Security Onchain Risk Map converts documented security incidents into reusable evidence for

+ Ethereum builders. It maps failures across software delivery, wallets, signing, account

+ authorization, infrastructure, and execution using typed relationships and explicit

+ evidence confidence.

+ This grant will fund an open, versioned Ethereum dataset with at least 30 independently

+ reviewed incidents, 30 defensive-control assessments, and tools for comparing failures.

+ External use will be documented through public work products from at least six

+ organizations. $0 of $50,000 0.0% Donate Details Grant Exploit Exposure Layer: Free Data on Every Wallet Still Approved to an Exploited Contract After an exploit, the token approvals users granted to the exploited contract stay live and keep getting drained, sometimes for years. Revoke.cash will scan every supported chain for every contract on its public exploit list, compute which wallets are still exposed, and serve that data through a free API so any wallet or explorer can warn its own users. The multichain exploit check on Revoke.cash moves out of the paid tier and becomes free, and a public metrics page tracks exposure, revocations, and value at risk per exploit. $0 of $100,000 0.0% Donate Details Grant TEE Security Handbook: practical verification, failure analysis and recovery for Ethereum Expand Bluethroat Labs' existing TEE Security Handbook with four reviewed engineering chapters, reusable security checklists and runnable examples. The work covers attestation verification, malicious-host interfaces, state recovery, and verification from source code to deployment. Funding also supports maintenance and documented use by independent Ethereum-facing teams. $0 of $18,000 0.0% Donate Details Grant From Community Contracts to OpenZeppelin Contracts: ERC-7540 Asynchronous Vaults OpenZeppelin Community Contracts is where OpenZeppelin and ecosystem teams build implementations of new standards before they enter OpenZeppelin Contracts, the trusted library Ethereum projects import. The ERC-7540 asynchronous vault suite, built with the Tokenized Vault Foundation and Centrifuge, is now complete but unaudited. This grant funds its audit, the fixes, the published report and its release in OpenZeppelin Contracts, so every tokenized fund, real-world asset pool and staking vault can build on it securely. $0 of $90,000 0.0% Donate Details Grant Ethereum Decompiler Benchmark & Open Bytecode Analysis Standard Build a public EVM decompiler benchmark and an open, vendor-neutral API/CLI specification for bytecode analysis. ExVul will serve as the first reference implementation, while the benchmark and specification are designed for independent use by other decompilers and security tools. The project also includes a $40,000 adoption milestone tied to publicly verifiable external use. $0 of $120,000 0.0% Donate Details RFP Spec Bank: a public, composable registry of formal specifications for DeFi DeFi protocols compose like Lego, but an understanding of what a protocol actually guarantees rarely travels with it, and the problem only gets worse as new systems integrate old ones. Spec Bank tests whether a public, permissionless registry can fix that: a protocol's formal model, called a spec, gets uploaded once, and afterward anyone can submit an invariant, a specific property, and have it proved or disproved against that spec automatically and in public. Invariants can build on other specs the way the protocols themselves do, so a downstream integrator can prove a property like "no loss of principal" by citing an upstream protocol's spec directly. This RFP funds a proof of concept testing whether that crowdsourcing mechanic actually works, with governance kept deliberately thin: specs and invariants that are correct and useful attract reuse, rather than needing a central body to debate their acceptance. $0 of $100,000 0.0% Donate Details Grant Fund Echidna Development Through 2027 Fund Gustavo Grieco, Echidna's creator and maintainer, to carry out Echidna's 2026 to 2027 roadmap during 2027: keep EVM execution current, improve campaign and worker architecture, strengthen symbolic verification, turn agent control into a dependable workflow and optimize execution performance. At minimum, the period produces three tagged maintenance or minor releases, at least two substantial roadmap outcomes delivered in tagged releases, three technical posts, and a public SKILL prompt and MCP workflow for AI agents. $0 of $48,000 0.0% Donate Details Grant Open EVM Compiler Differential Fuzzing Platform Every EVM contract is only as correct as the compiler that built it, and no contract audit catches a compiler bug. This grant turns a working prototype differential fuzzer into a maintained open source platform, then pays mainly for getting compiler teams to run it themselves. It already produced confirmed findings in solx, Sonatina and Plank. Nearly half the money pays only when named compiler teams run it against their own compilers, in their own CI. $0 of $75,000 0.0% Donate Details Grant Account Abstraction and Mempool Security Analytics EIPsInsight already tracks Ethereum standards, governance, upgrades, and on-chain usage in the open, including early mempool and MEV security signals.

+ EIPsInsight becomes an open security-visibility layer for Ethereum account abstraction and mempool risk analysis. This $45,000 grant funds a 3-month build of the security and network analytics infrastructure, centered on account abstraction with targeted mempool and MEV intelligence, plus a dedicated adoption milestone proven over a longer window of up to 12 months.

+ Account-abstraction focus (EIP-4337, EIP-7702, EIP-8141): cross-chain indexing, EntryPoint and set-code usage metrics, typed-transaction migration trends, gas economics, and threat watchlists for malicious sweeper contracts post-Pectra.

+ Mempool and MEV: post-Dencun analytics tracking sandwich attacks, extracted value in USD, block-level sandwiching rate, and customizable threat alerts.Account Abstraction and Mempool Security Analytics $0 of $45,000 0.0% Donate Details Grant Colibri — Production Infrastructure and Ecosystem Adoption for Trustless Ethereum Access This grant takes Colibri, a trustless stateless Ethereum client, from production-ready core to ecosystem-wide adoption in a single combined program. It funds hardening of the verification core, Pragmatic Adaptive Privacy, a verified transaction-security foundation, multi-chain expansion with a verification fallback, Go/C++ developer bindings, and a large-scale adoption push targeting at least 30 real application integrations, including 8 from a named list of high-value targets. $0 of $640,000 0.0% Donate Details Grant The Ethernaut: Six New Levels Built from Real-World Exploits The Ethernaut is OpenZeppelin's open-source wargame where developers learn smart contract security by exploiting real flaws, level by level. First delivered in 2017, The Ethernaut has been the first blockchain security experience for many devs and auditors in the space, and we strive every year to add new relevant exploits to it. This grant funds six new levels built from recent real-world exploits and published audit findings, reviewed and live on ethernaut.openzeppelin.com within 2 months. $0 of $44,000 0.0% Donate Details Grant Open Standard and Automated Triage Tooling for Ethereum Security Issues AI-assisted reporting has made security submissions cheap to write and expensive to check. This grant funds an open standard for deterministic proofs-of-concept (PoC), plus tooling that replays a submitted PoC, records a source-level trace, and flags invalid assumptions and bogus preconditions. Triagers get a faster way to tell a valid PoC from one that only fires inside a rigged test setup. Reporters get a way to build PoCs that hold up under real-world assumptions before they submit. $0 of $150,000 0.0% Donate Details Grant Securing Ethereum with Formal Verification AI is making it faster to attack software, giving attackers a meaningful edge. Formal verification is widely considered the strongest security guarantee in software correctness. This grant aims to increase formal verification adoption across the Ethereum ecosystem with TVL secured as its main success metric. $0 of $200,000 0.0% Donate Details RFP Provider-Independent, Client-Verified ENS Resolution Today a wallet or gateway resolves an ENS name with one call to one RPC provider and trusts the answer; the correct record is on the chain and nothing checks it. This RFP suggests a library that asks two independent sources, verifies against a block header, and flags disagreement, plus a public test suite that any .eth gateway operator can run to prove they resolve and serve names correctly, so more than one company can serve .eth sites. It is anchored on the April 2026 eth.limo registrar hijack, where one operator's DNSSEC setup was the only thing between 2 million .eth sites and phishing pages. Half the budget pays only on adoption by named wallets, dapps, and gateway operators. $0 of $150,000 0.0% Donate Details RFP Production-Ready Local-First Safe UI This RFP funds a production-ready, local-first Safe multisig UI, deployed to IPFS with reproducible builds, that anyone can run with nothing but an RPC endpoint and a wallet. It is an independent way to execute transactions if Safe for any reason becomes unreachable, and a tool to cross-check every hash before signers approve. $0 of $120,000 0.0% Donate Details Grant ForensIQ: Faster Ethereum Incident Response Through Evidence Reconstruction ForensIQ is building an open-source module that connects off-chain incident evidence (logs, files, transaction hashes) with Ethereum activity to reconstruct attack timelines, trace fund flows, and flag transfers to attributed exchange addresses. It replaces the manual handoffs between logs, block explorers, and attribution tools with one evidence-linked workflow that produces a verified response package faster. The grant funds the missing connective layer on top of ForensIQ's existing MVP (case management, Crystal and Etherscan integrations), not a rebuild of the platform. Success is measured through pilots with protocol, exchange, and law-enforcement investigators, tracking time to a verified timeline and correctness rather than a promised percentage improvement. $0 of $135,000 0.0% Donate Details RFP Directory of Value Before a security researcher can analyze a protocol, they have to find it, and today there is no neutral way to enumerate the contracts that actually hold value. Directory of Value is a permissionless registry where anyone can identify a contract as valuable, plus an open indexing layer that exposes every entry as data a researcher or an automated agent can query in full. It records identification without imposing judgment, and no single gatekeeper decides who appears. This RFP funds the specification, implementation, audit, deployment, and adoption of that directory. $0 of $185,000 0.0% Donate Details RFP Community Fuzzing Tooling for Ethereum Ecosystem Projects The Ethereum ecosystem is lacking a solution for scalable, continuous, and compute-intensive fuzzing campaigns for projects. For each project to subscribe to their own solution would be costly and could have diminishing returns over time to make it a worthwhile investment of time, money, and human capital. We are requesting proposals from applicants who have developed or can develop tools to orchestrate fuzzing at scale, assign compute resources efficiently, and flex these resources up and down in an agile manner so that any team can orchestrate their own fuzzing campaign for themselves. A self-serve model. This RFP would fund the construction and maintenance of such a tool. $0 of $150,000 0.0% Donate Details Grant A Unified Platform for Web3 OpSec Web3 OpSec tooling is fragmented. Frameworks, trainings, scanners and breach monitoring all exist, but they live in separate places and nobody has a single view of where they stand. This grant funds one platform that pulls them together into a task list with owners and statuses, so a team can see its posture and what to fix next. Auditware is the recipient: they've already built the foundation, and this opens it up to the ecosystem as a public good and funds its development into an impactful and full-featured platform. $0 of $250,000 0.0% Donate Details RFP OPSEC Ratings Coalition to Build & Maintain an "L2Beat for OPSEC" Fund a single coordinator to bring at least six OPSEC auditing firms together around one industry-agreed rating standard: an A / AA / AAA tier a team earns and renews yearly, with a six-month check-in and automatic suspension when its security posture changes. The firms already running OPSEC audits become the accredited raters, apply one shared scoring template inside their existing flow and publish tiers only, never a team's report or score. Rated teams pay a fixed fee into a membership body that owns the standard and the board once the coordinator hands off. A simple public board shows who is rated; teams with unacceptable OPSEC simply don't appear. $0 of $150,000 0.0% Donate Details Grant Automated EIP Compliance Checks for Ethereum Clients Ethereum's client teams implement EIPs by reading specification text and writing code, and conformance test suites only catch the divergences somebody thought to write a test for. PRSpec uses LLM analysis to compare EIP specification text directly against client source code and flag semantic mismatches, and it has already surfaced a real cross-client inconsistency in how EIP-1559's base-fee burn is implemented. This grant funds turning it from a research tool into a self-hosted pre-release check running in the staging pipelines of the major execution clients. $0 of $20,000 0.0% Donate Details Want to pledge support? Backers pledge now and pay only when the work is fully funded, with their logo on the initiative from day one. Email info@thedao.fund to pledge TheDAO Security Fund · coordinating ecosystem funding for Ethereum security. To back an initiative, email info@thedao.fund · Donation Terms © 2025– 2026 TheDAO LLC. All rights reserved. Support