Google Analytics counts our visits, with cookies. No thanks turns it off and removes its cookies; in Europe, the UK, Switzerland and India, or wherever we cannot tell where you are, it stays off unless you accept. Cookie Notice

Advertise
PRICES
BTCETHSOLXRPBNBTONDOTLTCPOLHBARNEARARBUNI

← Back to NewsDesk

AI summary of a third-party reportNeutralNewsDesk

Ethereum developers patch Glamsterdam deposit flaw after initial rejection

Ethereum developers merged a fix to Glamsterdam's deposit rules after first turning it down, closing a scenario where a builder could withdraw ETH meant for new validators. No losses were reported.

Why it matters: The flaw sat in deposit handling that staking services rely on, and the fix now has to be built into client software before Glamsterdam can move toward mainnet.

InvestIn.News NewsDesk · 1 min read
Share
Picture from CoinDesk for: Ethereum developers patch Glamsterdam deposit flaw after initial rejection
Image: CoinDesk
Original reporting: Shaurya Malwa, CoinDesk

Key points

  • Researcher avsetsin described a case where builder and validator deposits shared a public key, crediting both to the builder
  • The proposed fix was closed on 19 Oct and merged on the Monday after tests were added on 23 Oct
  • Glamsterdam's 26 Oct launch on the Hoodi test network was postponed and needs a new date before mainnet scheduling

Ethereum developers have patched a flaw in the Glamsterdam upgrade that could have let an operator withdraw ETH that staking services intended for new validators, CoinDesk reports. The change to the deposit rules was merged on the Monday after developers had rejected it a week earlier.

Glamsterdam separates two roles that are currently combined: builders assemble blocks of transactions, while validators stake ETH and confirm them. Both can deposit ETH, and the upgrade's draft rules were meant to track their money separately. Researcher avsetsin set out a scenario in which an operator registers as a builder under a public key, then a staking service deposits ETH to start a validator under the same key, so both deposits are credited to the builder. The operator could then withdraw the funds, and no validator is created, leaving the staking service without the proof needed to recover its money.

Avsetsin, listed as a member of Lido's GitHub organisation, examined how Lido, Origin and Rocket Pool might be affected and described the findings as conditional code findings rather than confirmed live exploits. Existing checks rejecting an earlier builder deposit could block the attack, and no losses have been reported.

Justin Traglia, who maintains Ethereum's consensus specifications, wrote that clients did not support the change at the time it was closed on 19 Oct. Pending deposits are now sorted by withdrawal credentials, so validator deposits stay with validators even when a builder uses the same key.

What to watch: Glamsterdam needs a new Hoodi test network date before a mainnet launch can be scheduled.

Read the full story on CoinDesk

Live updates on NewsFeeds:EthereumDesk editor: Keshav Aggarwal (accountable for this page; this summary was not edited by hand)

How this was produced: an AI model wrote this summary of CoinDesk’s report, which we credit and link above. Read our Editorial and AI policy. Spotted a mistake? See Corrections.

Not investment advice. Read the risk disclaimer.

← Back to NewsDesk