Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders.

Ethereum developers have patched a flaw in the upcoming Glamsterdam upgrade that could have let an operator siphon ETH intended for new staking validators. The fix was merged on Monday after being initially rejected a week earlier.

The bug arose when pending deposits were processed; if a builder registered with a public key and a staking service later deposited ETH for a validator using the same key, both deposits would be credited to the builder, allowing the operator to withdraw the funds without creating a validator.

Researcher avsetsin, a Lido GitHub member, outlined the scenario and tested it against Lido, Origin and Rocket Pool. No losses have been reported and existing checks could block the exploit. The revised rules now sort pending deposits by withdrawal credentials, keeping validator deposits separate. The change is in Ethereum’s consensus specs, but client teams still need to implement it. Glamsterdam has run on Sepolia, while its Hoodi launch has been postponed pending a new date before mainnet deployment.

Summary rewritten by AI from the original article by CoinDesk.