Ethereum merges Glamsterdam fix for validator deposit flaw

Ethereum developers merged a change to the Glamsterdam upgrade specification on October 26 to prevent pending validator deposits from being routed to a block builder when both use the same public key. The flaw concerned rules for a future network upgrade, not a confirmed exploit of Ethereum’s live mainnet. The revised rule classifies deposits by their withdrawal credentials, which determine how funds may eventually be withdrawn. Validator deposits are kept in the validator queue even when a builder has registered with the same key. The change also includes regression tests for deposit ordering and routing during the transition. The issue involved Gloas, the consensus-layer portion of Glamsterdam, and how the network would process deposits still pending when the upgrade takes effect. Under the earlier draft rules, a builder registered with a public key could have had later deposits using that key credited to its balance, regardless of their withdrawal credentials. In the described scenario, a validator funded by a staking service might not be created, while its deposit could be credited to the builder instead. Researcher avsetsin identified the conditional scenario. The...