Ethereum developers have resolved a critical vulnerability in the upcoming Glamsterdam upgrade that could have allowed an operator to siphon ETH intended for new validators. The flaw, identified by researcher Avsetsin, involved builder and validator deposits sharing a public key, potentially allowing funds meant for validators to be credited to builders instead. This would have left staking services unable to recover their funds, as the protocol's funds could have been withdrawn without the staking service being able to prove ownership. The fix, which altered the rules for handling validator deposits, was merged Monday after a week-long review process. The vulnerability was discovered during the upgrade itself, when Ethereum would process deposits still waiting to be credited. Avsetsin, a member of Lido’s GitHub organization, examined how Lido, Origin, and Rocket Pool could be affected. The findings were described as conditional code findings, not confirmed live exploits. Developers initially rejected the fix on Oct. 19 due to insufficient client support, but it was reopened after further review and merged Monday. Under the new rules, pending deposits are sorted by withdrawal credentials, ensuring validator deposits remain with validators even if a builder is using the same key. The change is now part of Ethereum’s consensus specifications, but client teams still need to implement it in their software. Glamsterdam has already run on the Sepolia test network, but its Oct. 26 launch on Hoodi, a second test network, was postponed. A new Hoodi date is needed before a mainnet launch can be scheduled.
The fix was necessary to prevent potential fraudulently diverting staking funds. The vulnerability highlighted the importance of careful code review and client collaboration in Ethereum upgrades. While no losses have been reported, the incident underscores the need for rigorous testing and validation of new features before they go live. The Ethereum community continues to work on ensuring the security and integrity of the network as it moves toward its mainnet launch.
The issue also highlights the complex interplay between different components of the Ethereum ecosystem, including validators, builders, and client software. As Ethereum prepares for its mainnet launch, the community remains focused on preventing similar vulnerabilities from compromising the network's stability.
The Ethereum community continues to work on improving the security and reliability of the network, with a focus on preventing future vulnerabilities that could compromise the stability of the blockchain.