ethereum ·
Ethereum reverses course, fixes Glamsterdam validator deposit flaw
Ethereum developers have merged a fix for a deposit-handling flaw in the upcoming Glamsterdam upgrade that could have allowed a block builder to receive ETH intended for a new validator, following an initial decision to reject the proposed change.
According to Ethereum's consensus specifications, maintainer Justin Traglia merged the correction on October 26 after developer avsetsin identified a problem with how pending deposits would be processed during the Gloas fork. The change separates builder deposits from validator deposits according to their withdrawal credentials, preventing funds from entering the wrong account when both use the same public key.
The vulnerability concerned rules under development, not a confirmed theft from Ethereum's mainnet. Developers have incorporated the correction into the specifications, although individual consensus clients still need to implement and test the revised behavior.
The issue emerged from changes planned under Glamsterdam's enshrined proposer-builder separation, which assigns block construction and block proposal to different roles. Builders assemble transaction payloads, while validators participate in proposing and confirming blocks through Ethereum's proof-of-stake system. Researcher avsetsin described the flaw on October 12, identifying a problem in the rules used to process deposits waiting when the network upgrades.
