Ethereum Resolves Glamsterdam Bug That Could Have Redirected Staking Deposits

Ethereum developers have fixed an issue in their new Glamsterdam update that could have allowed an individual to walk away with funds intended to be used as deposits by new validators. The bug fix, which made changes to how the deposit contract works, was incorporated on Monday following a rejection from the developers one week earlier. Glamsterdam separates two tasks that are bundled together today. Builders bundle transactions into blocks, and validators who stake ETH to help protect the network select and validate them. 

Ethereum Developers Update Deposit Handling to Separate Validator Funds

The issue appeared during the upgrade when Ethereum processes deposits that have not yet been credited. It was highlighted by a researcher named Avsetsin, who found that in a case where the operator registers himself as a builder by using a specific public key, that is, the unique key of the validator or the builder. In this case, if the staking service deposits some ETH for validation through this public key, the draft rule would credit both deposits to the builder.

“The operator can withdraw the protocol's funds,” Avsetsin wrote. The validator is not generated, so it cannot generate the proof required for recovering its funds. Avsetsin, who is one of the members of Lido's GitHub organisation, conducted a study on the vulnerabilities of Lido, Origin, and Rocket Pool, which he termed “quick AI research.” The results were based on the method used by each protocol in depositing funds. 

“These are conditional code findings, not confirmed live exploits,” avsetsin stated, while pointing out that any existing check that rejects the earlier builder's deposit may prevent the attack.

This proposed fix was closed by the developers on October 19. “There was not enough support from clients to make this change at this time,” said Justin Traglia, the person in charge of maintaining the Ethereum consensus specifications. Here, the client refers to the distinct software that the validators use to join the network. However, the patch was eventually reopened following an evaluation and was then merged by Traglia on October 28th.  

Pending deposits will be segregated based on the withdrawal credentials, which are the attributes that specify where the funds deposited could eventually be withdrawn to. Validator deposits will remain with them regardless of whether the same key is used by a builder. The update has become part of the Ethereum consensus specification but is still yet to be implemented by the client teams. Glamsterdam has been successfully tested on the Sepolia testnet, although its rollout on the Hoodi testnet on October 26 was delayed.
  
Last week, the Ethereum development team postponed the Glamsterdam upgrade in the Hoodi test network after researchers discovered a vulnerability in the code that might affect the way existing smart contracts deal with failed transactions. The upgrade had been put off for further evaluation in light of an All Core Devs Execution meeting held by developers. The issue revolved around EIP-8037, which modifies how Ethereum fees are calculated for adding new entries to its database.