- Published on
Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders
- Authors
- Name
- DeepHorus
Ethereum developers have patched a Glamsterdam upgrade flaw that could have allowed an operator to withdraw ETH intended for new validators. The deposit-handling fix was merged Monday, a week after developers rejected it. No losses have been reported.
Glamsterdam separates builders, who bundle transactions into blocks, from validators, who stake ETH to secure and confirm the network. Both can deposit ETH, and their funds are meant to be tracked separately. The flaw appeared when Ethereum processed deposits still awaiting credit.
Researcher Avsetsin found an operator could register as a builder with a public key, then receive a staking service’s validator deposit under that key. Draft rules would credit both deposits to the builder, which could withdraw them while no validator was created. The staking service then lacked proof needed to recover its money.
Avsetsin, listed in Lido’s GitHub organization, examined Lido, Origin, and Rocket Pool in “quick AI research.” The researcher called the results “conditional code findings, not confirmed live exploits,” and said existing checks could block the attack. No losses were reported.
Developers closed the proposed fix on Oct. 19. Justin Traglia, who maintains Ethereum’s consensus specifications, cited “not enough support from clients.” The fix was reopened after further review, Avsetsin added tests on Oct. 23, and Traglia merged it Monday.
Under the new rules, pending deposits are sorted by withdrawal credentials, which determine where funds can eventually go. Validator deposits stay with validators even if a builder uses the same key. The change is now in Ethereum’s consensus specifications, but client teams must still build it into their software.
Glamsterdam has run on the Sepolia test network, but its Oct. 26 launch on Hoodi was postponed. Glamsterdam needs a new Hoodi date before developers can schedule a mainnet launch. The delay gives client teams more time to incorporate the revised deposit rules.
