Ethereum clients have patched a vulnerability that could have redirected ETH deposits intended for new validators to builder accounts. The flaw was discovered in draft rules for Glamsterdam, Ethereum's upcoming upgrade, and was fixed before any funds were compromised.
The Vulnerability
Researcher avsetsin identified the issue within the draft specifications for ePBS, or enshrined proposer-builder separation, a core component of the Glamsterdam upgrade. Under the draft rules, when a builder and validator used the same public key, staking deposits could be mistakenly credited to the builder account.
The fix alters how deposits are routed. Instead of relying solely on public keys, the revised protocol directs deposits based on withdrawal credentials.
Patch Timeline
The fix initially faced rejection on October 19, 2026, due to insufficient client support. Following reassessment, maintainer Justin Traglia merged the change into the consensus specifications between October 23 and October 28, 2026.
Testing on Ethereum's testnets produced mixed results. The Sepolia testnet successfully executed the update, while Hoodi testnet postponed its activation following the fix.
What Glamsterdam Represents
Glamsterdam formalizes the separation between block builders and validators within Ethereum's protocol. Currently, this separation occurs largely outside the core protocol. ePBS aims to embed this division directly into Ethereum's rules, making the distinction between these roles a fundamental part of the network's structure.
Implications for Stakers
For ETH stakers and prospective validators, the corrected deposit logic based on withdrawal credentials rather than public keys alone provides assurance that no funds were lost and that the protocol's safeguards have been strengthened before the upgrade activation.
