Ethereum developers have agreed on a fix for a flaw in the upcoming Glamsterdam upgrade that could have sent staking deposits to the wrong account. The correction was merged into the network’s technical specifications on October 26.
The issue is about a proposed change to Ethereum, not a confirmed theft. Glamsterdam has not launched on the main network, and the teams building Ethereum’s software will still need to incorporate the revised rules.
How staking deposits could have gone astray
Ethereum relies on validators to help it secure its network. To become a validator, an operator deposits ETH, and they do this with the help of a staking service.
Glamsterdam introduces a separate role for block builders, who assemble transactions. Builders can also make deposits, but those funds are meant to be tracked separately from validators’ ETH.
George Avsetsin [a researcher] discovered that the proposed rules could lead to confusion between the two during the upgrade. If a builder and a new validator used the same public key, a validator deposit waiting to be processed could be credited to the builder instead, by mistake.
Depending on the circumstances, an operator controlling that builder account can then withdraw the funds that is supposed to be for staking. The researcher said these are potential risks, not as attacks that are confirmed.
The merged change is designed to ensure that validators’ deposits are kept in the proper queue, even when a builder uses the same key.
Developers reconsidered the proposed fix
The correction did not go through on its first attempt. Developers closed the proposal on October 19 because there was not enough support from the teams responsible for Ethereum’s software.
They then reopened it on October 23, and after further review and additional tests, the change was merged three days later.
That decision came while Glamsterdam’s testing schedule was already being revised. The Ethereum Foundation postponed an October 26 activation on the Hoodi test network to investigate a separate issue involving how another proposed change could affect existing applications.
The Foundation said that it has not set a new Hoodi date yet, and no time has been set for the mainnet launch either.
For now, the deposit fix is part of the planned upgrade rules. The next step is for software teams to build and test those rules as Glamsterdam moves toward another public test.
Data from DefiLlama showed that there are currently 17.13 million staked ETH, worth close to $40 billion.
Final Summary
- Developers merged a fix for a potential staking deposit flaw in Ethereum’s planned Glamsterdam upgrade.
- Hoodi testing was postponed over a separate issue, with no replacement date announced.