Posts tagged validators.
How we're building cross-chain ML detection for blockchain validator infrastructure
How we built a wire-shape detector that transfers across chains. V8 trained only on Sui hit 51 out of 51 zero-shot on Solana attacks it had never seen, because mechanism-class features carry across chains while host-telemetry features don't.
Why ML Detection on Validator Infrastructure Keeps Reporting ROC = 1.000
V1 of our trainer scored ROC = 1.000 across all 17 folds. Two minutes of audit found why. Eight leak surfaces later, here's the apparatus that stops you fooling yourself with one.
Introducing Substrate: An Open Format for Validator Threat Intelligence
Validator threat intelligence has no shared format. We're publishing a bundle spec, a ten-family taxonomy, and seeding a 1,092-bundle corpus to fix that.
We Scanned 5,700 [Solana, Eth, Sui, Atom] Validators. Here's What We Found.
NullRabbit scanned 5,715 validator hosts across Solana and Sui, running 10,139 scans and identifying 1,340 CVE findings across 155 hosts. Here's what the validator attack surface actually looks like.
Slashr: Real-Time Validator Incident Tracking Across Four Networks
Slashr tracks validator delinquency, jailing, slashing, and missed votes across Solana, Ethereum, Sui, and Cosmos in real time. Wallet checks, rankings, automated scanning, and reliability reports -- all from on-chain data.
Connecting Slashr to Your AI Workflow via MCP
Slashr now has a Model Context Protocol server. Any MCP-compatible AI tool -- Claude Code, Claude Desktop, or custom agents -- can query live validator incident data, scan results, and network summaries directly.
Introducing Slashr: A Live Feed of Every Validator Incident
Validators go down constantly. Almost nobody is watching it happen in real time, across chains, in one place. So we built slashr.dev, a live incident feed tracking Solana, Ethereum, Sui, and Cosmos.
DeFi Under the Microscope: 1,075 Hosts, 3,001 Ports, One Timing Scan
A first look at what DeFi validator infrastructure looks like at the kernel level. We crack open the consolidated dataset -- embedding galaxies, jitter fingerprints, RTT ridgelines, and 10,000 anomaly events across 642 silent hosts.
What Does a DeFi Network Actually Look Like?
Every blockchain network has a physical fingerprint. We pointed our eBPF/XDP scanner at 1,075 hosts across multiple DeFi validator networks and mapped 3,001 timing fingerprints to reveal the structure underneath the consensus layer.
What We Found Scanning the Sui Validator Network
We scanned 138 Sui validators across 20 countries using kernel-level temporal fingerprinting. 41% have SSH exposed, 57 run unexpected internet-facing services, and 9 confirmed CVEs sit on 4 hosts -- including 2 critical at CVSS 9.8. Here is what we found and why it matters for DeFi.
How Solana Shrugged Off a 6 Tbps DDoS
Solana reportedly absorbed a sustained ~6 Tbps volumetric DDoS attack with no downtime. That's real progress. It's also not the same thing as being protected.
No One Really Knows What's Hitting Their Infrastructure
I ran a SYN flood against my own server and watched every log file I could find. Nothing. Not a single line. Here's why Linux won't tell you about scans - and the tools that actually will.
XDP Inline Defense for Validators: Kernel-Level Protection at Line Rate
Validator nodes face constant exposure. This deep dive explains how NullRabbit Guard uses eBPF and XDP to enforce security directly inside the NIC driver, dropping scans and abnormal traffic at line rate before they reach the kernel or your node.
10 Open-Source Security Tools Every Validator Operator Should Run
Protect your validator or RPC node with these ten open-source tools. From port scanners to intrusion prevention, here's the ultimate DIY stack for decentralized infrastructure security.