Ethereum developers patch Glamsterdam bug to safeguard staking deposits
Ethereum developers have merged a fix for an issue in the upcoming Glamsterdam upgrade that could have misallocated queued staking deposits to block builders rather than validators.
Ethereum core developers merged a fix on Oct. 26 to resolve a flaw in the upcoming Glamsterdam upgrade that could have routed stakers' validator deposits into block builder accounts. The issue existed in the proposed consensus-layer upgrade rules rather than on the active mainnet, and no funds were lost as a result of the bug.[2][3]
First reported on Oct. 12 by Lido Chief Protocol Architect George Avsetsin, the vulnerability involved Gloas, the consensus-layer component of Glamsterdam that provides block builders with their own registry. Under the original fork specifications, if a pending deposit registered a builder for a given public key, all subsequent pending deposits for that key would flow to the builder regardless of their credentials. Avsetsin noted that if an operator queued a builder deposit and a staking protocol subsequently funded a validator deposit using the same key, both sums would divert to the builder at fork activation. Preliminary findings flagged contracts from Lido, Origin, and Rocket Pool as potentially exposed under conditional scenarios.[3]
Ethereum researcher Justin Traglia initially closed the pull request on Oct. 19 due to a lack of client team support. However, testing delays soon altered the deployment schedule; developers unscheduled Glamsterdam's Oct. 26 activation on the Hoodi testnet following its Oct. 6 launch on Sepolia. On Oct. 23, Lido Staking Head of Engineering Dmitry Gusakov requested the issue be reopened in light of the postponed timeline.[1][2][3]
The additional time allowed developers to thoroughly vet the change across clients. Prysm developer Potuz approved the proposal with requests for further testing, and ChainSafe Protocol Engineer Nico Flaig confirmed that the Lodestar client passed all evaluations with clean differential testing. Traglia approved and merged the update on Oct. 26, ensuring that pending deposits are separated by withdrawal credentials so validator funds remain with validators. Ethereum client teams must still incorporate the fix into their implementations.[2][3]
Key facts
- The merged fix addresses a Glamsterdam consensus flaw that could have credited queued validator deposits to block builder accounts.
- No funds were lost, as the flaw existed in proposed upgrade specifications rather than live Ethereum mainnet code.
- Lido Chief Protocol Architect George Avsetsin discovered the issue on Oct. 12 and authored the pull request.
- The change modifies Gloas to inspect withdrawal credentials on pending deposits at activation, ensuring builder accounts receive only builder-designated deposits.
- The proposal was initially closed on Oct. 19 for lack of client support before being reopened on Oct. 23 when Glamsterdam's timeline changed.
- Glamsterdam's planned Oct. 26 activation on the Hoodi testnet was postponed, following an earlier launch on the Sepolia testnet on Oct. 6.
- Ethereum researcher Justin Traglia merged the fix on Oct. 26 after approvals from Prysm and Lodestar client engineers, though client teams must still implement it.
Sources · 3 sources
- CO
CoindeskArticle ·
Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders Developers initially rejected the change before reversing course, as testing delays gave them more time to examine a flaw in Ethereum's upcoming Glamsterdam upgrade.
Open source - C®
CryptoSavingExpert ®@CryptoSavingExpPost on X ·
Ethereum developers have patched a flaw in the upcoming Glamsterdam upgrade that could have sent ETH meant for new validators to a block builder. No losses have been reported. This was a flaw in the proposed upgrade rules, not a live exploit. The Hoodi testnet launch has also been postponed, and client teams still need to implement the fix. We'd rather see Ethereum delay an upgrade than rush a consensus change and risk real funds.
Open source - UN
UnchainedArticle ·
Ethereum Developers Merge Glamsterdam Fix to Keep Validator Deposits Out of Builder Accounts Ethereum developers merged a fix on Oct. 26 for a Glamsterdam bug that could have credited a staker’s validator deposit to someone else’s builder account, one week after closing the same change for lack of client support. The pull request , written by Lido Chief Protocol Architect George Avsetsin , changes how Gloas , the consensus-layer half of the upgrade, treats deposits still sitting in the queue when the fork activates. The new rule looks at the withdrawal credentials on every deposit still pending at activation. Those meant for validators stay put, and builder accounts get funded only by deposits with builder credentials. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . How the Bug Worked Glamsterdam gives block builders a registry of their own, separate from validators. In a bug report filed on Oct. 12, Avsetsin wrote that “the party that pays for a deposit is not always the key holder.” Under the old fork rules, once a pending deposit registered a builder for a public key, every later deposit for that key went to the builder, whatever credentials it carried. The report walked through an operator who queues a builder deposit for a new key, after which a staking protocol funds a validator deposit for the same key. “If both deposits are pending at the fork, both amounts go to the builder. The operator can withdraw the protocol’s funds,” Avsetsin wrote. In a follow-up comment, the author shared what they called “quick AI research” naming Lido , Origin and Rocket Pool contracts that could be affected, and warned it “may contain errors.” The comment added, “These are conditional code findings, not confirmed live exploits.” Closed, Then Reopened Ethereum researcher Justin Traglia closed the issue and the fix on Oct. 19 after discussions on two developer calls, writing that “there was not enough support from clients to make this change at this time.” Three days later, developers unscheduled Glamsterdam’s Oct. 26 activation on the Hoodi testnet , which had followed the upgrade’s Sepolia launch on Oct. 6 . On Oct. 23, Lido Staking Head of Engineering Dmitry Gusakov asked to reopen the issue “due to changes in the Glamsterdam timeline and a potential chance to fix it.” Prysm developer Potuz approved the change that day while asking for extra tests. “I’m still scared of putting this change before the fork,” Potuz wrote in the review , adding that with the fork’s status now “Unknown,” there was “more than adequate time to study this change both in the specs and how it affects our caches.” ChainSafe Protocol Engineer Nico Flaig approved on Oct. 26, saying the Lodestar client “is passing them too on my branch” and that extra differential testing turned up no findings. Traglia approved and merged the fix the same day. Related Listen: Why an Ethereum Proposal to Zero Out Staking Yield Sparked a Revolt The post Ethereum Developers Merge Glamsterdam Fix to Keep Validator Deposits Out of Builder Accounts appeared first on Unchained .
Open source