Ethereum fixes the Glamsterdam vulnerability: preventing staked deposits from being mistakenly credited to builder accounts

According to CoinDesk, Ethereum developers have fixed a vulnerability in the Glamsterdam upgrade that could allow operators to withdraw ETH intended for new validators from the staking service. The fix changed the handling rules for validator deposits and was merged on Monday, after developers had rejected the modification a week earlier.

Researcher avsetsin discovered that if an operator first registers as a builder with a specific public key, and the staking service subsequently deposits ETH using the same key to activate the validator, the draft rules would credit both deposits to the builder. Avsetsin stated that this is a conditional code discovery and not a confirmed real-time exploit; existing checks can prevent the attack, and there are currently no reports of losses. The new rules treat deposits as sorted by withdrawal receipts, ensuring that validator deposits still belong to the validators.

Glamsterdam has been running on the Sepolia testnet, but the launch on the Hoodi testnet has been delayed, with a new date to be determined before the mainnet launch.