Ethereum developers merge Glamsterdam fix for staking deposit flaw

Key points

• Ethereum developers merged a fix on Oct. 26 for a Glamsterdam deposit flaw
• Builder and validator deposits sharing a key could have been credited to the builder
• Deposits are now routed by withdrawal credentials; no losses reported
• Hoodi testnet launch was postponed; client teams must still implement the fix

Ethereum developers on Monday merged a fix for a flaw in the upcoming Glamsterdam upgrade that could have let a builder claim staking deposits meant for new validators, CoinDesk reported. No losses have been reported, according to the outlet.

The change was merged Oct. 26 into the Ethereum consensus specifications by Justin Traglia, who maintains them, after an on-and-off review that began earlier in the month.

How the Glamsterdam deposit flaw worked

According to CoinDesk, the problem arose because builder deposits and validator deposits could share the same public key. In that case, both deposits could be credited to the builder, and an operator could then withdraw ETH that a staking service had intended for a new validator.

The researcher who raised the issue, Avsetsin, is listed as a member of Lido’s GitHub organization, CoinDesk said. Avsetsin examined how Lido, Origin and Rocket Pool could be affected and described the results as “conditional code findings, not confirmed live exploits,” according to the report.

What the merged change does

The pull request, titled “Separate builder and validator deposits at the Gloas fork,” changes how pending deposits are routed. They are now sorted by withdrawal credentials instead of by whether a validator or builder already uses the public key. Validator deposits stay in the validator queue even if a builder uses the same key, and a valid builder deposit registers or tops up a builder even if a validator uses that key.

The pull request page shows Avsetsin opened it on Oct. 12 to address a related issue. The change also adds regression tests for deposit routing and ordering.

Reversal during review

Traglia closed the proposal on Oct. 19, writing that clients had not given enough support for the change at that time, according to the pull request. He reopened it on Oct. 23. CoinDesk’s feed summary said testing delays gave developers more time to examine the flaw.

A reviewer known as potuz approved on Oct. 23. He said he found no exploit but flagged a minor risk of fund loss in one scenario involving builder deposits followed by top-ups with zeroed addresses and invalid signatures, and he asked for more tests. Avsetsin added them. On Oct. 26, reviewer nflaig approved after reporting that the Lodestar client passes the new tests. Traglia also approved and merged the change.

What happens next for Glamsterdam

Client teams still need to implement the change before Glamsterdam can move toward mainnet, according to CoinDesk. The upgrade has run on the Sepolia test network, but its Oct. 26 launch on the Hoodi test network was postponed. A new Hoodi date is needed before a mainnet date can be set.

Separately, a search of other coverage found reports that Lido engineering head Dima Gusakov raised the deposit-redirect risk on an Oct. 20 Ethereum developer call, and that the exposure was tied to the hard-fork transition period. Those details were not confirmed in the primary sources reviewed.

CoinDesk also reported on Oct. 23 that Ethereum delayed a Glamsterdam test after security developers flagged a risk to existing contracts.