Ethereum Developers Reverse Course and Patch a Glamsterdam Deposit Flaw Before Launch

A week after turning it down, Ethereum’s developers have merged a fix for a deposit problem in the Glamsterdam upgrade. Justin Traglia, who maintains the consensus specifications, first closed the proposal on October 19 because client teams had not shown enough support. After more review, it was reopened, test cases were added on October 23, and it was approved Monday.

How the Validator Deposit Flaw Worked

Glamsterdam separates builders, who assemble blocks, from validators, who stake ETH to confirm them. Researcher Avsetsin showed that an operator could register as a builder with a specific public key. If a staking service later sent a deposit for a new validator under that same key, the draft rules would credit everything to the builder. No validator would exist, so the service could not prove ownership and recover its funds. Avsetsin studied Lido, Origin and Rocket Pool, stressing these were conditional findings rather than confirmed exploits. No losses have been reported.

What Changes in the Deposit Rules

Pending deposits will now be sorted by withdrawal credentials, so validator money stays with validators even when a builder shares the key.

Glamsterdam Testnet Delay and Next Steps

Client teams must still add the fix to their software. The Hoodi test network launch planned for October 26 was postponed, and a new date is needed before mainnet can be scheduled. Sepolia has already run the upgrade.