Ethereum Patches Glamsterdam Bug Protecting Staker Funds

EthereumETH-0.72% developers recently resolved a serious flaw in the network's upcoming Glamsterdam upgrade. The bug could have accidentally sent ETH staking deposits to transaction builders instead of validators.

Security researchers spotted the issue during code reviews before any mainnet deployment. No user funds were lost, and core developers have updated the code to ensure validator ETH remains fully secure.

Understanding the Glamsterdam Upgrade

To understand this bug, it helps to look at what the Glamsterdam upgrade changes. Currently, Ethereum bundles transaction creation and block approval together.

Glamsterdam separates these responsibilities into two distinct roles. Builders collect transactions and assemble them into blocks. Validators stake ETH to confirm those blocks and keep the network running.

Think of it like a restaurant kitchen. Builders act as chefs preparing meals, while validators serve as inspectors checking quality before dishes reach customers.

Both builders and validators deposit ETH to participate in the network. Ethereum's code is designed to track these deposits separately using unique cryptographic keys.

How the Deposit Bug Worked

The vulnerability occurred when processing deposits waiting to be credited on the blockchain.

A security researcher known as avsetsin, affiliated with Lido's GitHub group, identified the flaw during code testing.

If an operator registered as a builder using a specific public key, a problem arose. If a staking service later sent ETH to start a validator using that same key, draft rules confused the two.

Instead of setting up a new validator, the network would credit both deposits directly to the builder.

"The operator can withdraw the protocol's funds," avsetsin noted in the research analysis.

Because no validator was officially created in that scenario, the staking service could not generate the cryptographic proof needed to retrieve its funds.

Evaluating the Risk Level

Avsetsin evaluated how liquid staking protocols like Lido, Origin, and Rocket PoolRPL-0.55% might be affected based on their deposit methods.

The researcher clarified that these findings were theoretical vulnerabilities uncovered during routine testing, rather than active exploits on a live network.

Existing network checks that reject duplicate builder keys would have likely stopped potential exploits. No financial losses were reported.

From Rejection to Approval

Fixing code in decentralized software requires agreement among multiple development teams.

On October 19, core developers initially closed the proposed code fix. Justin Traglia, a maintainer of Ethereum's consensus specifications, noted there was insufficient support from client software teams at that time.

However, testing continued. Avsetsin submitted additional test cases on October 23 to demonstrate the scenario clearly.

After reviewing the additional evidence, developers reopened the issue, and Traglia officially merged the patch.

How the Updated Deposit Rules Work

The revised patch changes how pending deposits are sorted before processing.

Instead of relying only on public keys, pending deposits are now organized by their withdrawal credentials. Withdrawal credentials act like a set destination address for funds.

This rule guarantees validator deposits remain assigned to validators, even if a builder shares an identical key.

Next Steps for the Glamsterdam Release

Glamsterdam has already run tests on the Sepolia test network. However, a planned trial on the Hoodi testnet scheduled for October 26 was postponed to incorporate the patch.

Client teams must now update their software programs to reflect these updated specification rules.

A new test date for Hoodi will be determined before developers set a schedule for mainnet deployment.

Other Industry News Summaries

Along with Ethereum's technical updates, several other notable events occurred across the cryptocurrency space:

• Zcash Ecosystem: Zcash's co-founder proposed ending grant funding, pointing to a $125 million treasury.
• Banking Approvals: RippleXRP+0.85% received final approval to establish a U.S. national trust bank.
• Corporate Strategy: Tom Lee's Bitmine announced a preference for share buybacks over Ether acquisitions.
• Prediction Markets: The NBA partnered with CFTC-regulated prediction markets, while the NFL opted out.
• Global Regulation: South Korea is considering pushing its crypto gains tax to 2029, while Canada released draft rules for stablecoins.

In market activity, BitcoinBTC-0.67% traded near $80,000 as investors observed broader macroeconomic signals.

Past performance of digital assets is no guarantee of future results. Digital asset markets experience ongoing price volatility.