Ethereum developers have patched a flaw in the upcoming Glamsterdam upgrade that could have let someone walk off with ETH that staking services meant for new validators.
The fix, which changed the rules for handling validator deposits, was merged Monday, a week after developers turned it down.
Glamsterdam splits up two jobs that are bundled together today. Builders put blocks of transactions together, and validators, who stake ETH to help secure the network, pick and confirm them. Both can deposit ETH, and their money is supposed to be tracked separately.
The problem appeared during the upgrade itself, when Ethereum would process deposits that were still waiting to be credited.
Researcher avsetsin identified a scenario in which an operator first registers as a builder using a particular public key, the identifier tied to a validator or builder. If a staking service then deposits ETH to start a validator under that key, the draft rules would credit both deposits to the builder.
“The operator can withdraw the protocol’s funds,” avsetsin wrote. No validator gets created, so the staking service can’t produce the proof it would need to recover its money.
Avsetsin, who is listed as a member of Lido’s GitHub organization, looked at how Lido, Origin and Rocket Pool could be affected, in what the researcher called “quick AI research.” The findings depended on how each protocol handles deposits.
“These are conditional code findings, not confirmed live exploits,” avsetsin wrote, adding that existing checks rejecting an earlier builder deposit could stop the attack. No losses have been reported.
Developers closed the proposed fix on Oct. 19. “There was not enough support from clients to make this change at this time,” wrote Justin Traglia, who maintains Ethereum’s consensus specifications. Clients are the separate software programs validators run to take part in the network.
The fix was reopened after further review, avsetsin added tests on Oct. 23, and Traglia merged it Monday.
Under the new rules, pending deposits are sorted by their withdrawal credentials, the setting that says where a deposit’s money can eventually go. Validator deposits stay with validators even if a builder is using the same key.
The change is now part of Ethereum’s consensus specifications, and client teams still have to build it into their software. Glamsterdam has already run on the Sepolia test network, but its Oct. 26 launch on Hoodi, a second test network, was postponed.
Glamsterdam needs a new Hoodi date before a mainnet launch can be scheduled.
Read More: Ethereum delays Glamsterdam test after security devs flag risk to existing contracts