CoinDesk
Ethereum developers patched a flaw in the upcoming Glamsterdam upgrade that could have allowed an operator to withdraw ETH intended for new validators. The issue involved builder and validator deposits sharing a public key, which could have caused both deposits to be credited to the builder. No losses have been reported, and the fix was merged after developers reopened a change initially rejected for lacking client support.
Why it matters
Glamsterdam separates two roles that are currently bundled together: builders assemble transaction blocks, while validators stake ETH and confirm them. Both roles can deposit funds, but those deposits must remain separately attributable during the upgrade's processing of pending deposits.
Researcher avsetsin identified a conditional scenario in which an operator first registered as a builder under a public key, then a staking service deposited ETH to create a validator using the same key. Under the draft rules, the funds could have been credited to the builder, leaving the staking service without a validator or the proof needed to recover its deposit. The finding was not a confirmed live exploit and depended on how protocols including Lido, Origin and Rocket Pool handle deposits.
Market impact
The revised rules sort pending deposits by withdrawal credentials, ensuring validator deposits remain with validators even when a builder uses the same key. The change is now part of Ethereum's consensus specifications, but client teams still need to incorporate it into their software before the upgrade can move forward.
Glamsterdam has already run on Sepolia, while its Hoodi testnet launch was postponed. Developers need to set a new Hoodi date before scheduling a mainnet launch. The episode highlights the importance of extended testing for upgrade logic that could affect staking services and ETH custody.
Frequently asked questions
-
What flaw did Ethereum patch in the Glamsterdam upgrade?
A builder and validator could share a public key, potentially causing both deposits to be credited to the builder instead of creating the validator.
-
Were any staking funds lost because of the Glamsterdam bug?
No losses have been reported. Researchers described the issue as a conditional code finding rather than a confirmed live exploit.
-
How does the revised deposit rule protect validator funds?
Pending deposits are sorted by withdrawal credentials, keeping validator deposits with validators even when a builder uses the same public key.
-
Which staking protocols could have been affected?
The finding examined possible effects on Lido, Origin and Rocket Pool, depending on how each protocol handles deposits.
-
What must happen before Glamsterdam reaches Ethereum mainnet?
Client teams must implement the revised consensus rules, and developers need to set a new Hoodi testnet date before scheduling a mainnet launch.
CryptoSlate
WuBlockchain
Crypto News
WatcherGuru
CoinTelegraph
Crypto Rank News
TheBlock