Ethereum fixes Glamsterdam builder deposit flaw

Ethereum’s consensus specifications now keep validator deposits and builder deposits apart at the Gloas fork, the consensus-layer half of the Glamsterdam upgrade. The fix, pull request #5736, was closed on 19 Oct, given tests on 23 Oct and merged on Monday at 19:16 UTC. No losses have been reported; the flaw sat in rules that have not reached mainnet.

The rundown

What changed: At the fork, deposits still waiting in the queue are now sorted by their withdrawal credentials, the field that says where a deposit’s money can eventually be withdrawn. Validators, who stake ETH to propose and attest to blocks, keep validator deposits. Builders, the new in-protocol role that assembles block contents, keep builder deposits, even when both use the same public key.
Why it matters: The researcher avsetsin laid out the problem in issue #5735 on 12 Oct. Under the draft routing rule, once a pending deposit registered a builder, later deposits for that key topped up the builder whatever their credentials said. So an operator could queue a builder deposit, wait for a staking protocol to fund a validator deposit under the same key, and collect both at the fork. “The operator can withdraw the protocol’s funds,” the issue says. Because no validator is created, the protocol also loses the proof it would normally use to check or recover the stake.
Where it breaks: This was a near miss on process, not just code. Justin Traglia, who maintains the specifications, closed the first version on 19 Oct, writing that “there was not enough support from clients to make this change at this time”. It went in a week later. Every client team now has to implement it, and the researcher’s own review of Lido, Origin and Rocket Pool described “conditional code findings, not confirmed live exploits”, according to CoinDesk. Whether a given protocol was exposed depends on how it sequences deposits.
By the numbers: 12 Oct issue filed. 19 Oct fix closed. 23 Oct tests added. 26 Oct merged. Zero reported losses.

The schedule has not moved because there was nothing left to move. Developers postponed Glamsterdam’s Hoodi test over EIP-8037 last week, scrapping the 26 Oct Hoodi date set on 9 Oct, and no new date has been set.

The upgrade is already live on the Sepolia testnet, according to CoinDesk. A mainnet date depends on Hoodi first.

Spec change: Separate builder and validator deposits at the Gloas fork (ethereum/consensus-specs #5736)

This article is for information only and is not investment advice.