Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders
Ethereum developers patched a flaw in the upcoming Glamsterdam upgrade that could have allowed an operator to withdraw ETH intended for new validators.
The vulnerability involved builder and validator deposits sharing a public key, potentially crediting both deposits to the builder and leaving staking services unable to recover their funds. No losses have been reported, and client teams must now incorporate the revised deposit rules before Glamsterdam can proceed toward a mainnet launch.
Deposit Vulnerability
Glamsterdam splits up two jobs that are bundled together today. Builders put blocks of transactions together, and validators, who stake ETH to help secure the network, pick and confirm them. Both can deposit ETH, and their money is supposed to be tracked separately.
The problem appeared during the upgrade itself, when Ethereum would process deposits that were still waiting to be credited. Researcher avsetsin identified a scenario in which an operator first registers as a builder using a particular public key, the identifier tied to a validator or builder.
The operator can withdraw the protocol's funds
Fix Implementation
Developers closed the proposed fix on Oct. 19, but reopened it after further review. Avsetsin added tests on Oct. 23, and Traglia merged it Monday. Under the new rules, pending deposits are sorted by their withdrawal credentials, the setting that says where a deposit's money can eventually go.
Validator deposits stay with validators even if a builder is using the same key. The change is now part of Ethereum's consensus specifications, and client teams still have to build it into their software. Glamsterdam has already run on the Sepolia test network, but its Oct. 26 launch on Hoodi, a second test network, was postponed.
Related
