An open-source agent for validator hosts. It learns your traffic in shadow mode, keeps a log of what it would have blocked, and enforces only when you grant it authority, one abuse class at a time. Enforcement is an XDP drop in your kernel: microseconds, nothing else in the path.
$ curl -fsSL nullrabbit.ai/ibsr | sh$ ibsr observe --shadow▸ baseline · 7d · learning▸ counterfactual · 847 would-block$ ibsr evidence --tail▸ shadow.log · awaiting sign-off
Exploit discovery is being automated. Validator infrastructure, hundreds of independent operators with no shared SOC, is exposed to it.
A DoS-plus-consensus exploit on Litecoin's MWEB caused a 13-block reorganisation with roughly $600K in cross-chain exposure. The patch had been available for 37 days. Not a zero-day - a known-day that defenders couldn't close in time.
Two major decentralized networks were hit with sustained DDoS in the same week. Same wave, different outcomes. The difference was the defensive substrate underneath - most chains don't have one.
Runs passive first. It baselines your real traffic and blocks nothing until you turn enforcement on.
Every detection is recorded: what would have been dropped, and why. Read it before you grant anything.
Enforcement is per abuse class and revocable. There is no global on switch.
Drops happen in your kernel, in microseconds. No proxy, no added hop.
A detection on one node ships to the rest of the cohort.
Read it, build it, run it air-gapped.
Most vendors ask for root on day one and call it trust. Here, authority is granted in stages, by evidence, and revocable at any time. The framework is published and peer-reviewable.
Read the framework →IBSR observes packets in passive mode. No enforcement. Counterfactual evidence accumulates.
Operator grants authority for one abuse class. Guard begins enforcing for that class only.
Authority expands by evidence, never by request. Each class is opt-in and revocable.
Cohort-wide policy. One validator's judgment becomes another's protection.
Under the hood, NullRabbit is three components: IBSR for judgment, Guard for enforcement, Mesh for shared intelligence.
Trained on 1,092 contract-validated attack bundles across an open ten-family taxonomy. Public sample set on Hugging Face.
The corpus is built in-house: we generate and contract-validate attacks across the taxonomy, then train against versioned, immutable snapshots of it.
Evaluation is pre-registered and audited with falsification holdouts. When an audit fires, we re-register. We do not quietly iterate.
8 founding seats. We need your time and your telemetry, not your trust. In return: full platform access, roadmap influence, and founding pricing locked in.
You own protocol policy. Authorise a cohort, shape the taxonomy.
One judgment on your fleet protects every delegator behind it.
DDoS, scraping and RPC abuse are your daily reality.
See what is actually probing your nodes. Start with the open-source agent.