Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders

Ethereum developers have resolved a flaw in the upcoming Glamsterdam upgrade that could have allowed someone to steal ETH intended for new validators' staking deposits. The fix, which alters rules for managing validator deposits, was initially rejected a week ago but was reopened after further review and subsequently merged on Monday.

Glamsterdam separates two tasks that are merged in the current version: builders compile transaction blocks while validators, who stake ETH to secure the network, select and confirm them. Both can deposit ETH, and their funds should remain separate. The issue emerged during the upgrade when Ethereum processed deposits that were still awaiting confirmation.

Researcher avsetsin discovered a situation where an operator registered as a builder using a specific public key, tied to a validator or builder. If a staking service then deposited ETH to initiate a validator under that key, the draft rules would credit both deposits to the builder. Avsetsin explained that the operator could then withdraw the protocol's funds, but no validator would be created, preventing the staking service from generating the proof needed to recover its money.

Avsetsin tested how Lido, Origin, and Rocket Pool could be affected, noting that existing checks rejecting an earlier builder deposit could prevent the attack. No losses have been reported. The fix was initially closed on October 19, as there wasn't enough support from clients to implement the change at that time. However, it was reopened after Avsetsin conducted additional tests on October 23, and Justin Traglia, who maintains Ethereum’s consensus specifications, merged it on Monday.

The updated rules now sort pending deposits by their withdrawal credentials, ensuring that validator deposits remain with validators even if a builder shares the same key.