Vulnerability Discovered in Ethereum Client Ahead of Glamsterdam

A vulnerability has been identified in the Ethereum Lighthouse consensus client, which under certain conditions can disrupt the validation of validators' signatures. The issue is related to the global cache of public keys used to match validators with their indexes in the network. The bug could manifest during the transition to Gloas, a consensus layer update within Glamsterdam. Developers have prepared a fix on GitHub, but at the time of review, the pull request for its inclusion in the code remained open.

How the Ethereum Vulnerability Works

To execute the described attack, three deposits awaiting processing are required just before the update: a significant balance top-up for an existing validator and two deposits with new public keys. In the main chain, the top-up consumes the available deposit processing limit, so the other two are processed after the transition to Gloas. In an alternative branch, an attacker can achieve a different processing sequence if the existing validator is penalized for violating consensus rules.

As a result, one public key receives an index that in the main chain belongs to another validator. Due to the error in the global cache, affected nodes may use incorrect key-to-index mapping, reject valid signatures, and diverge from the main chain. According to the developers, implementing such a scenario requires the precise alignment of several conditions, including the creation of an alternative blockchain branch.

What the Fix Will Change Before Glamsterdam

The proposed fix by the developers limits the addition of public keys to the global cache: now they must be added only after the final confirmation of the corresponding stage of validator activation. An additional structure, HeadPubkeys, will allow combining information from the current chain state and the global cache so that keys remain accessible even during finalization without the appearance of new blocks.

It is still unknown whether a similar error exists in other Ethereum consensus clients. The discovered issue highlights the need for additional testing of validator processing mechanisms before activating Glamsterdam on the main network.