Ethereum Merges a Glamsterdam Deposit Fix It Closed a Week Ago

Ethereum's developers merged a change to the network's consensus specifications on Monday that stops one party's staking money landing in another party's account. Under the draft rules for Glamsterdam, the next upgrade, a deposit meant to create a new validator could be credited instead to a block builder who had already claimed the same public key. "The operator can withdraw the protocol's funds," the researcher who filed the report wrote. The same fix was closed on 19 October for want of support from client teams. It came back four days later and went in on the 26th.

Where the money would have gone

Glamsterdam separates two jobs that one party does today. Builders assemble transactions into blocks; validators, who stake ether to help secure the network, choose and confirm them. Both can deposit ether, and the two balances are meant to be kept apart. The flaw sat in fork onboarding, the moment the upgrade works through deposits still waiting to be credited. Once a pending deposit had registered a builder for a public key, the identifier tied to a validator or a builder, any later deposit for that key topped up the builder whatever its withdrawal credentials said. Those credentials are the setting that fixes where a deposit's money can eventually go.

The worked example runs like this. An operator queues a valid builder deposit against their own execution address. A staking protocol then funds a validator deposit for the same key. If both sit pending at the fork, both amounts go to the builder and no validator is created. The protocol cannot then produce the proof it needs to recover the money.

Conditional findings, by the author's own account

The report was opened on 12 October by a contributor posting as avsetsin, who went on to check three staking protocols against it and labelled that work "quick AI research to identify potentially affected protocols" that "may contain errors". Lido's predeposit guarantee loses its 1 ETH predeposit while compensation requires a validator proof, leaving the operator's guarantee locked and 31 ETH staged. Rocket Pool's remaining 31 ETH waits out a dissolve timeout. The author is careful about the status of all of it.

"These are conditional code findings, not confirmed live exploits," avsetsin wrote, adding that pre-deposit checks rejecting an earlier builder deposit can stop the scenario outright. The report also says permanent freezes are not established. CoinDesk, which carried the story in the early hours of Tuesday, describes the researcher as listed in Lido's GitHub organisation and reports that no losses have occurred. Both of those rest on CoinDesk alone.

Closed on the 19th, reopened on the 23rd

Justin Traglia, who maintains the consensus specifications, shut the proposal down a week before it passed.

"I'm going to close this. We discussed this topic at ACDC last week & ACDT today. There was not enough support from clients to make this change at this time," Traglia wrote on 19 October.

Four days later a second contributor, dgusakov, asked for it back "due to changes in the Glamsterdam timeline and a potential chance to fix it". Traglia reopened it the same day. The changed timeline is what made room: Glamsterdam was pulled off the Hoodi test network on 22 October over an unrelated gas-repricing finding, which took the deadline off the calendar. CoinDesk says the researcher added tests on 23 October. The public timeline shows the reopening that day and does not date the tests.

Specification now, software later

The merged rule sorts pending deposits by withdrawal credentials, so a validator deposit stays with validators even where a builder is using the same key. What exists is a description. Client teams, who write the separate programs node operators run, still have to build the change into their software, and none of that has shipped. Glamsterdam has already run on the Sepolia test network, where the old deposit rules applied and nothing was lost.

Two dates are missing and they come in order. Hoodi has no replacement slot, and until it does a mainnet schedule has nothing to follow.