Important Ethereum (ETH) Bug Might Be Finally Fixed

The vulnerability was identified in a mechanism where the client stores validator public keys and their indexes in a global cache. The attack required three pending deposits just before the fork: a large top-up for an existing validator and two new keys with different credentials.

On the canonical chain, the top-up would consume balance churn, causing the new keys to be processed after the fork. However, on the attacker's side chain, the topped-up validator could be slashed before the fork, causing the deposit to be skipped and altering validator indexes.

Technical Fix

According to the pull request on GitHub, the fix adds keys to the global pubkey cache only once their activation eligibility epoch is finalized. A new HeadPubkeys structure combines keys from the head state and the global cache to prevent nodes from missing keys if the chain finalizes without new blocks.

Attack Complexity

The attack is considered complex to execute, requiring precise timing of a slashing event and creation of a side chain. This makes accidental exploitation unlikely, though developers continue to address potential vulnerabilities as the upgrade approaches.