SecurityTokenizer
Subscribe Our Newsletter
Ethereum reverses course, fixes Glamsterdam validator deposit flaw
207
Oct 27, 2026
Ethereum developers have merged a fix for a deposit-handling flaw in the upcoming Glamsterdam upgrade that could have allowed a block builder to receive ETH intended for a new validator, following an initial decision to reject the proposed change.
According to Ethereum’s consensus specifications, maintainer Justin Traglia merged the correction on October 26 after developer avsetsin identified a problem with how pending deposits would be processed during the Gloas fork. The change separates builder deposits from validator deposits according to their withdrawal credentials, preventing funds from entering the wrong account when both use the same public key.
The vulnerability concerned rules under development, not a confirmed theft from Ethereum’s mainnet. Developers have incorporated the correction into the specifications, although individual consensus clients still need to implement and test the revised behavior.
Ethereum Glamsterdam flaw exposed validator deposit risk
The issue emerged from changes planned under Glamsterdam’s enshrined proposer-builder separation, which assigns block construction and block proposal to different roles. Builders assemble transaction payloads, while validators participate in proposing and confirming blocks through Ethereum’s proof-of-stake system.
Researcher avsetsin described the flaw on October 12, identifying a problem in the rules used to process deposits waiting when the network upgrades. If a builder registered using a public key before a validator deposit arrived under the same key, the proposed logic could credit both deposits to the builder.
The researcher outlined a scenario involving a staking operator receiving funds from a liquid staking protocol to establish a new validator. By registering as a builder first, the operator could cause the protocol’s validator deposit to enter the builder balance, where the withdrawal address could be under the operator’s control.
Since the expected validator would not be created, the staking service could struggle to obtain the proof needed to complete its normal deposit and recovery procedures.
The researcher examined potential exposure involving Lido, Origin and Rocket Pool through preliminary code research. Those findings were conditional on how individual protocols handled deposits, and the report did not establish that the projects had suffered an exploit.
Developers reverse decision after further review
The proposed correction initially encountered resistance from Ethereum client developers, despite the researcher’s description of the deposit-routing risk. On October 19, Traglia closed the pull request after discussions among core developers.
The decision did not remain in place, with developers reopening the proposal on October 23 following further examination.
Subsequently, reviewer potuz approved the approach but requested more tests for specific deposit combinations. Avsetsin added those tests on October 23, covering cases in which builder and validator deposits share a public key but require separate handling.
The final change was merged into Ethereum’s consensus specifications on October 26 after further client review. It directs valid validator deposits into the validator queue while allowing legitimate builder deposits to register or add funds to an existing builder.
The new rules distinguish deposits through withdrawal credentials, which determine the permitted withdrawal arrangements. They preserve separate builder and validator records even where the same public key appears in both roles.
Hoodi delay gives developers more time to investigate
The specification update arrived while Ethereum developers were reviewing a separate problem affecting Glamsterdam’s scheduled activation on the Hoodi testnet. The Ethereum Foundation postponed the October 26 upgrade after researchers identified compatibility risks involving EIP-8037.
Sources >> Ethereum reverses course, fixes Glamsterdam validator deposit flaw
Trending News
Subscribe Our Newsletter
