Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders

Avsetsin, who is listed as a member of Lido’s GitHub organization, looked at how Lido, Origin and Rocket Pool could be affected, in what the researcher called “quick AI research.” The findings depended on how each protocol handles deposits.

“These are conditional code findings, not confirmed live exploits,” avsetsin wrote, adding that existing checks rejecting an earlier builder deposit could stop the attack. No losses have been reported.

Turned down, then merged

Developers closed the proposed fix on Oct. 19. “There was not enough support from clients to make this change at this time,” wrote Justin Traglia, who maintains Ethereum’s consensus specifications. Clients are the separate software programs validators run to take part in the network.

The fix was reopened after further review, avsetsin added tests on Oct. 23, and Traglia merged it Monday.

Under the new rules, pending deposits are sorted by their withdrawal credentials, the setting that says where a deposit’s money can eventually go. Validator deposits stay with validators even if a builder is using the same key.

The change is now part of Ethereum’s consensus specifications, and client teams still have to build it into their software. Glamsterdam has already run on the Sepolia test network, but its Oct. 26 launch on Hoodi, a second test network, was postponed.