Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders

Ethereum developers patched a vulnerability within the forthcoming Glamsterdam upgrade. This flaw could have permitted an operator to withdraw ETH designated for new validators.

The vulnerability stemmed from builder and validator deposits sharing a public key. This arrangement risked crediting both deposits to the builder, leaving staking services unable to reclaim their funds. No losses have been reported regarding this issue.

The fix, which modifies the rules for handling validator deposits, was merged on Monday. This occurred one week after developers initially rejected the change.

Glamsterdam currently merges two functions: builders bundle transactions into blocks, while validators, who stake ETH for network security, select and confirm these transactions. Both entities can deposit ETH, and their funds are meant to be tracked separately.

Researcher Avsetsin identified a scenario during the upgrade where Ethereum processes pending deposits. If an operator registers as a builder using a specific public key, and a staking service subsequently deposits ETH under that same key, the draft rules would credit both deposits to the builder. Avsetsin noted, "The operator can withdraw the protocol’s funds." Since no validator is created, the staking service cannot generate the proof necessary to recover its money.

Avsetsin, who is listed as a member of Lido’s GitHub organization, examined the potential impact on Lido, Origin, and Rocket Pool in what he termed “quick AI research.” He stated, "These are conditional code findings, not confirmed live exploits," adding that existing checks rejecting an earlier builder deposit might prevent the attack.

Initially, developers closed the proposed fix on Oct. 19, citing that "There was not enough support from clients to make this change at this time," according to Justin Traglia, who maintains Ethereum’s consensus specifications. Clients are the distinct software programs validators operate to participate in the network.

Following further review, Avsetsin added tests on Oct. 23, and Traglia merged the fix on Monday. The revised rules mandate that pending deposits are sorted according to their withdrawal credentials. This ensures validator deposits remain with validators even if a builder utilizes the identical key.

This change is now incorporated into Ethereum’s consensus specifications; however, client teams must still integrate it into their software. Glamsterdam previously ran on the Sepolia test network, but its Oct. 26 launch on Hoodi, a second test network, has been postponed, requiring a new Hoodi date before a mainnet launch can be scheduled.