Ethereum patches Glamsterdam deposit flaw ahead of further testnet rollout

Traders Union
All News
Crypto
Ethereum Glamsterdam deposit patch

Highlights

Ethereum developers merged a patch on Monday addressing a deposit vulnerability in the upcoming Glamsterdam upgrade after initially declining the fix on Oct. 19.
The fix ensures pending deposits are sorted by withdrawal credentials, preventing builder and validator deposit overlap even if the same public key is used.
Glamsterdam has run on the Sepolia testnet, but its Oct. 26 launch on Hoodi was postponed with no new date, delaying mainnet scheduling.

Patch reverses earlier developer decision

As first reported by CoinDesk, the fix was merged on Monday, one week after Ethereum developers declined the proposed change. The issue affects how the network handles validator deposits that are still pending during the Glamsterdam upgrade process.

Glamsterdam separates two functions that are currently bundled together on Ethereum. Builders assemble blocks of transactions, while validators, who stake ETH to help secure the network, select and confirm those blocks, and both groups can make deposits that are meant to remain distinct.

Researcher avsetsin described a scenario in which an operator first registers as a builder with a specific public key. If a staking service then sends ETH to launch a validator under the same key, the draft rules could credit both deposits to the builder, allowing the operator to withdraw the funds while no validator is created.

Avsetsin, listed as a member of Lido's GitHub organization, examined possible effects on Lido, Origin and Rocket Pool. The researcher said the findings were conditional and not confirmed live exploits, and added that existing checks blocking an earlier builder deposit could prevent the attack; no losses have been reported.

Testnet timeline and client work remain

Developers closed the proposed fix on Oct. 19 after what Justin Traglia, maintainer of Ethereum's consensus specifications, described as insufficient support from client teams. The proposal was reopened after further review, avsetsin added tests on Oct. 23, and Traglia merged the change on Monday.

Under the updated rules, pending deposits are sorted by withdrawal credentials, the setting that determines where a deposit's funds can ultimately go. That means validator deposits remain tied to validators even when a builder uses the same public key.

The patch is now part of Ethereum's consensus specifications, but client teams still need to implement it in their software. Glamsterdam has already run on the Sepolia test network, while its Oct. 26 launch on Hoodi, a second test network, was postponed, leaving the upgrade without a new Hoodi date before any mainnet launch can be scheduled.

Cohere’s planned acquisition of AI cybersecurity startup AISLE highlights the company’s push to strengthen enterprise security as it expands in Europe alongside its tie-up with Aleph Alpha. Our earlier article noted that AISLE’s tooling focuses on finding software vulnerabilities, adding threat detection capabilities and supporting private, on-premise deployments for enterprise and public-sector clients.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.