Ethereum developers have patched a flaw in the upcoming Glamsterdam upgrade that could have allowed an operator to withdraw ETH intended for new validators. The vulnerability has now been merged into Ethereum's consensus specifications, though client teams must still implement the changes before mainnet launch.
The Glamsterdam upgrade is designed to separate two roles currently bundled together: builders, who assemble transaction blocks, and validators, who stake ETH to secure the network and confirm blocks. Both roles can deposit ETH, and their funds are meant to be tracked separately.
How the Vulnerability Worked
The flaw emerged during the upgrade process when Ethereum would process pending deposits. Researcher avsetsin identified a scenario where an operator could register as a builder using a specific public key, then have a staking service deposit ETH to create a validator under that same key. Under the draft rules, both deposits would be credited to the builder account.
In this scenario, the operator could withdraw the combined funds, and no validator would be created. This would prevent the staking service from generating the proof needed to recover its money. Avsetsin noted that existing checks rejecting an earlier builder deposit could potentially stop such an attack, and no losses have been reported.
Path to Implementation
Developers initially rejected the fix on October 19, with Ethereum consensus specification maintainer Justin Traglia citing insufficient support from client teams. After further review and testing, the fix was reopened on October 23 and merged on Monday.
The revised rules now sort pending deposits by their withdrawal credentials, ensuring that validator deposits remain with validators even when a builder uses the same public key. Client teams must now incorporate these changes into their software before Glamsterdam can proceed to mainnet launch. The upgrade has already been tested on the Sepolia test network.
