Home
Cryptocurrency
Cryptocurrency News
Ethereum Resolves Glamsterdam Bug That Could Have Redirected Staking Deposits

Ethereum Resolves Glamsterdam Bug That Could Have Redirected Staking Deposits

The fix separates pending validator deposits according to withdrawal credentials, preventing builders from claiming funds intended for staking.

Written by Rahul Dhingra, Edited by Rohan Pal | Updated: 27 October 2026 19:59 IST

Ethereum Resolves Glamsterdam Bug That Could Have Redirected Staking Deposits

Photo Credit: Unsplash/Shubham Dhage

Glamsterdam separates block building from validator selection and transaction validation

Click Here to Add Gadgets360 As A Trusted Source

Highlights

Researcher Avsetsin identified the potential deposit vulnerability
The patch was merged into Ethereum’s consensus specifications
Client teams must still implement the proposed changes

Ethereum developers have fixed an issue in their new Glamsterdam update that could have allowed an individual to walk away with funds intended to be used as deposits by new validators. The bug fix, which made changes to how the deposit contract works, was incorporated on Monday following a rejection from the developers one week earlier. Glamsterdam separates two tasks that are bundled together today. Builders bundle transactions into blocks, and validators who stake ETH to help protect the network select and validate them.

Ethereum Developers Update Deposit Handling to Separate Validator Funds

The issue appeared during the upgrade when Ethereum processes deposits that have not yet been credited. It was highlighted by a researcher named Avsetsin, who found that in a case where the operator registers himself as a builder by using a specific public key, that is, the unique key of the validator or the builder. In this case, if the staking service deposits some ETH for validation through this public key, the draft rule would credit both deposits to the builder.

Ethereum Blockchain Discussion

Explore More...

“The operator can withdraw the protocol's funds,” Avsetsin wrote. The validator is not generated, so it cannot generate the proof required for recovering its funds. Avsetsin, who is one of the members of Lido's GitHub organisation, conducted a study on the vulnerabilities of Lido, Origin, and Rocket Pool, which he termed “quick AI research.” The results were based on the method used by each protocol in depositing funds.

Canada Invites Feedback on Stablecoin Rules Following US GENIUS Act

“These are conditional code findings, not confirmed live exploits,” avsetsin stated, while pointing out that any existing check that rejects the earlier builder's deposit may prevent the attack.

This proposed fix was closed by the developers on October 19. “There was not enough support from clients to make this change at this time,” said Justin Traglia, the person in charge of maintaining the Ethereum consensus specifications. Here, the client refers to the distinct software that the validators use to join the network. However, the patch was eventually reopened following an evaluation and was then merged by Traglia on October 28th.

Pending deposits will be segregated based on the withdrawal credentials, which are the attributes that specify where the funds deposited could eventually be withdrawn to. Validator deposits will remain with them regardless of whether the same key is used by a builder. The update has become part of the Ethereum consensus specification but is still yet to be implemented by the client teams. Glamsterdam has been successfully tested on the Sepolia testnet, although its rollout on the Hoodi testnet on October 26 was delayed.

Last week, the Ethereum development team postponed the Glamsterdam upgrade in the Hoodi test network after researchers discovered a vulnerability in the code that might affect the way existing smart contracts deal with failed transactions. The upgrade had been put off for further evaluation in light of an All Core Devs Execution meeting held by developers. The issue revolved around EIP-8037, which modifies how Ethereum fees are calculated for adding new entries to its database.

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Ethereum blockchain, Crypto Upgrades, ETH, Crypto Developers

Rahul Dhingra

Email Rahul Dhingra

Rahul Dhingra is a crypto writer at Gadgets 360, where he covers the exciting world of Cryptocurrency, Blockchain, Defi and Web3. Before joining Gadgets 360, he worked as a content specialist for a European-based Crypto Exchange. Rahul loves storytelling, not just through the written word but also through the visual medium. Beyond his professional life, Rahul is a sports fanatic. Whether it’s cricket or football, his passion for the game is contagious. More