Ethereum Developers Fix Vulnerability in Glamsterdam Update

Ethereum developers have fixed a vulnerability in the upcoming Glamsterdam update that could have allowed someone to withdraw ETH intended by staking services for new validators. The fix, which changes the rules for processing deposits, was merged on Monday—a week after it was initially rejected.

Glamsterdam separates two functions: builders assemble blocks, while validators staking ETH select and confirm them. Both contribute ETH, and the funds must be accounted for separately. The issue arose in processing deposits awaiting crediting. Researcher avsetsin described a scenario: an operator registers as a builder with a specific public key, then a staking service deposits ETH for a validator under the same key—the draft rules would credit both deposits to the builder. "The operator could withdraw protocol funds," wrote avsetsin. The validator is not created, and the service cannot obtain proof for fund return.

avsetsin checked Lido, Origin, and Rocket Pool in a "quick AI-assisted investigation," but emphasized: "These are conditional findings in the code, not confirmed exploits." Existing checks that reject an earlier builder deposit could stop the attack. No losses have been recorded.

Developers closed the fix on October 19: "At that time, clients did not show sufficient support," wrote Justin Truglia, who supports consensus specifications. After further analysis, avsetsin added tests on October 23, and Truglia merged the fix on Monday. Under the new rules, pending deposits are sorted by withdrawal credentials: validator deposits remain with the validators, even if the builder uses the same key. The change has been included in the consensus specifications, but client teams have yet to implement it in software. Glamsterdam has already passed on Sepolia, but the launch on Hoodi scheduled for October 26 has been postponed.