Ethereum Fixes Glamsterdam Bug to Stop Staking Deposits Being Credited to Builder Accounts

October 27: According to CoinDesk, Ethereum developers have fixed a bug in the Glamsterdam upgrade that could have let operators take ETH that staking services had earmarked for new validators. The fix changes the rules for processing validator deposits and was merged on Monday, a week after developers had rejected the change.

Researcher avsetsin found that if an operator first registers as a builder with a specific public key, and a staking service then deposits ETH using the same key to launch a validator, the draft rules would credit both deposits to the builder. avsetsin said this was a conditional code finding rather than a confirmed live exploit, that existing checks can block the attack, and that no losses have been reported so far. The new rules sort pending deposits by withdrawal credentials, so validator deposits remain attributed to the validator. Glamsterdam is already running on the Sepolia testnet, but its launch on the Hoodi testnet on October 26 was postponed, and a new date must be set before mainnet launch.