Ethereum developers fix Glamsterdam deposit-handling flaw

Ethereum developers have merged a fix for a deposit-handling vulnerability identified in the upcoming Glamsterdam upgrade. The flaw, discovered by researcher avsetsin, could have allowed staking deposits intended for a new validator to be incorrectly credited to a block builder if both roles shared the same public key.

The issue arose from proposed changes in the enshrined proposer-builder separation, which aims to decouple block construction from block proposal. Under the original logic, pending deposits processed during the network upgrade could have been misdirected to a builder's account.

While the vulnerability was identified in the rules under development, there have been no confirmed thefts or exploits on the Ethereum mainnet. The correction has been incorporated into the consensus specifications, though individual consensus clients must still implement and test the revised behavior. An investigation into contract compatibility has delayed the activation of the Hoodi component of the upgrade.