Ethereum merges Glamsterdam fix for bug that could misdirect staking deposits to builders

Ethereum developers have patched a flaw in the planned Glamsterdam upgrade that could have allowed an operator to take ETH that staking services intended for new validators. The change to how validator deposits are handled was merged on Monday, a week after developers had closed the proposal.

Glamsterdam separates two roles that are combined today. Builders assemble transactions into blocks, while validators, who stake ETH to help secure the network, select and confirm them. Both can deposit ETH, and the protocol is meant to account for those funds separately.

The issue arose when the upgrade processed deposits that were still waiting to be credited. Researcher Avsetsin described a scenario in which an operator first registers as a builder under a particular public key. If a staking service later deposits ETH to start a validator under the same key, the draft rules would credit both deposits to the builder. In that case no validator would be created, so the staking service could not produce the proof needed to recover its money. Avsetsin wrote that the operator could withdraw the protocol's funds.

Avsetsin, listed as a member of Lido's GitHub organization, looked at how Lido, Origin and Rocket Pool might be affected, calling it quick AI research. The researcher stressed that the findings were conditional code findings rather than confirmed live exploits, and said existing checks that reject an earlier builder deposit could prevent the attack. No losses have been reported.

Developers closed the proposed fix on Oct. 19. Justin Traglia, who maintains Ethereum's consensus specifications, wrote that there was not enough support from clients to make the change at that time. The proposal was reopened after further review, tests were added on Oct. 23, and Traglia merged it Monday.

Under the new rules, pending deposits are sorted by their withdrawal credentials, the setting that determines where a deposit's funds can eventually go. Validator deposits therefore remain with validators even when a builder uses the same key.

The change is now part of the consensus specifications, but client teams still need to implement it in their software. Glamsterdam has already run on the Sepolia test network, but its Oct. 26 launch on the Hoodi test network was postponed. A new Hoodi date is needed before a mainnet launch can be scheduled.