Ethereum developers have merged a change to the upcoming Glamsterdam upgrade after identifying a flaw that could have allowed an operator to withdraw ETH intended for new validators.
The issue centered on how the upgrade would handle deposits that were still waiting to be credited. In a specific case where builder and validator deposits shared the same public key, both deposits could have been credited to the builder, leaving staking services unable to recover the validator funds.
How the flaw could occur
The problem arose from a change in deposit processing during the Glamsterdam upgrade itself. Ethereum would need to handle deposits that were still pending at the time of the transition, and under the new rules those pending deposits were sorted by withdrawal credentials, the setting that determines where a deposit’s funds can ultimately be sent.
That created a risk for deposits linked to the same public key. Builders and validators can both deposit ETH, but those balances are meant to be tracked separately. In the affected scenario, the system could have treated both deposits as belonging to the builder.
What the patch changes
The merged patch adjusts the rules for handling validator deposits so that validator funds remain assigned to validators even if a builder is using the same key.
In effect, the fix is meant to prevent a builder deposit from absorbing ETH that was meant to activate or fund a validator. That closes the path by which an operator could otherwise have withdrawn funds intended for staking.
Reversal after an initial rejection
Developers did not accept the change immediately. The proposal was initially rejected before they later reversed course.
According to the report, testing delays gave the development process more time to examine the bug in Glamsterdam. The fix was merged on Monday, one week after developers had turned it down.
Why the issue matters for Glamsterdam
Glamsterdam separates two roles that are currently bundled together on Ethereum. Builders assemble blocks of transactions, while validators stake ETH to help secure the network and select and confirm those blocks.
Because both roles can involve ETH deposits, keeping those funds distinct is a core requirement of the upgrade. The confirmed next step is that the merged fix will now be part of the planned Glamsterdam changes, addressing the identified deposit-crediting risk before the upgrade takes effect.
Source: www.coindesk.com