Ethereum developers have addressed a critical flaw in the upcoming Glamsterdam upgrade that could have allowed operators to misappropriate ETH intended for new validators. The vulnerability stemmed from builder and validator deposits sharing a public key, potentially crediting both deposits to the builder and leaving staking services unable to recover their funds.
The issue was identified by researcher avsetsin, who found that an operator could register as a builder using a specific public key. If a staking service then deposited ETH to start a validator under that key, the draft rules would incorrectly credit both deposits to the builder, enabling the operator to withdraw the funds. No validator would be created, making it impossible for the staking service to recover the money.
The fix, which adjusts the rules for handling validator deposits, was initially rejected on October 19 due to lack of support from client teams. However, after further review, the fix was reopened, additional tests were added on October 23, and it was merged on Monday. Under the new rules, pending deposits are sorted by their withdrawal credentials, ensuring validator deposits stay with validators even if a builder uses the same key.
The change is now part of Ethereum’s consensus specifications, but client teams must still incorporate it into their software before Glamsterdam can proceed toward a mainnet launch. The upgrade’s launch on the Hoodi test network, scheduled for October 26, has been postponed.