Ethereum Fixes Glamsterdam Flaw That Could Misroute Staking Deposits

Ethereum developers merged a fix at 3:16 p.m. ET Monday for a Glamsterdam flaw that threatened to hand a staking protocol's ETH to someone else. They had closed the same fix one week earlier.

How a deposit would have gone astray

Under Glamsterdam, builders and validators both deposit ETH, tracked apart. The bug sat in the one-time step that sorts deposits still waiting in line when the upgrade switches on. Under the draft rules, once a pending deposit registered a builder, later deposits under the same pubkey went to that builder, whatever their withdrawal credentials said.

The researcher avsetsin, who filed the GitHub issue on Oct. 12, gave an example. An operator queues a builder deposit. A staking protocol then funds a validator deposit under the same pubkey. If both are pending at the fork, "the operator can withdraw the protocol's funds," the issue says. No validator gets created, so the protocol can't produce the proof needed to recover the funds.

Closed, then merged

Maintainer Justin Traglia closed the pull request on Oct. 19, writing that "there was not enough support from clients to make this change at this time." Avsetsin added tests on Oct. 23, and Traglia reopened and merged it Monday. The new rule routes pending deposits by withdrawal credentials, so validator deposits stay with validators.

The flaw was in draft specs that have not reached mainnet. CoinDesk reported that no losses were reported and that a planned Oct. 26 launch on the Hoodi test network was postponed. Client teams still have to ship the change.

ETH traded at $2,306 at 5:58 a.m. ET, down 1.2% in 24 hours, per CoinGecko.

In our opinion: a fix that loses the room one week and wins it the next is code review doing its job. Better to sort out the deposit line in a draft spec than on mainnet.