Ethereum developers have achieved consensus on a solution for a vulnerability in the upcoming Glamsterdam upgrade that could have led to the misdirection of staking deposits to an incorrect account. The correction was incorporated into the network’s technical specifications on October 26. The matter at hand pertains to a suggested modification to Ethereum, rather than an established act of theft. Glamsterdam has not yet made its debut on the main network, and the teams responsible for developing Ethereum’s software will still need to incorporate the revised regulations.
Ethereum relies on validators to maintain the security of its network. To become a validator, an operator deposits ETH, facilitated by a staking service. Glamsterdam has carved out a unique niche for block builders, who are responsible for the assembly of transactions. Builders are allowed to make deposits; however, these funds are meant to be overseen separately from the ETH held by validators. George Avsetsin, a researcher, identified that the proposed regulations might create ambiguity between the two parties during the upgrade process. If a builder and a new validator utilised the same public key, there exists a possibility that a validator deposit awaiting processing could inadvertently be attributed to the builder instead.
Depending on the circumstances, an operator managing that builder account can subsequently withdraw the funds designated for staking. The researcher indicated that these represent potential risks rather than confirmed attacks. The merged change aims to ensure that validators’ deposits are preserved in the correct queue, even in cases where a builder utilises the same key. The correction failed to achieve success on its first attempt. Developers finalised the proposal on October 19, citing inadequate support from the teams responsible for Ethereum’s software. It was subsequently reopened on October 23, and after a comprehensive review and further testing, the modification was implemented three days later.
That decision was made while Glamsterdam’s testing schedule was already being revised. The Ethereum Foundation has postponed an activation set for October 26 on the Hoodi test network to investigate a separate issue concerning the possible effects of another proposed change on current applications. The Foundation indicated that a new Hoodi date has not yet been established, nor has a timeline been determined for the mainnet launch. At present, the proposed upgrade regulations encompass the deposit fix. The subsequent phase entails software teams developing and assessing those regulations as Glamsterdam advances toward another public trial. Data indicated that there are currently 17.13 million staked ETH, valued at nearly $40 billion.
