Ethereum developers have merged a consensus-layer specification fix for a deposit-routing flaw in the upcoming Glamsterdam upgrade, reversing an earlier decision to reject the change. The vulnerability could have allowed a malicious block builder to receive ETH intended for a new staking validator when both a builder deposit and a validator deposit shared the same public key while still pending at the Gloas fork.
The issue was first reported by researcher avsetsin on October 12. Under the original enshrined proposer-builder separation rules, any qualifying deposit queued at the fork would be converted into a builder account. If an operator first registered a builder for a fresh key from an address they controlled, and a pooled staking protocol later funded a validator deposit for that same key, the protocol's ETH would be credited to the operator's builder balance. The operator could then withdraw those funds, and no validator would be created. The researcher noted that designs such as Lido's predeposit guarantee, Origin's OETH and Rocket Pool's Saturn could have faced disruption, while describing these as conditional code findings rather than live exploits.
The proposed fix was initially closed on October 19 by consensus specifications maintainer Justin Traglia after core developer calls showed insufficient client support. However, the Ethereum Foundation's decision to postpone Glamsterdam's Hoodi testnet activation on October 22, because of a separate EIP-8037 smart contract compatibility investigation, opened extra time for the debate. On October 23, the deposit-ordering change was reopened, reviewer potuz approved the approach after requesting additional tests, and avsetsin added the required test cases. The correction was merged on October 26.
Under the new rule, withdrawal credentials rather than the public key determine where each pending deposit goes at the fork. Valid validator deposits stay in the validator queue, legitimate builder deposits can still register or fund an existing builder, and reusing one key for both roles remains possible, with the deposit's stated purpose deciding its destination. Client teams still need to ship identical implementations; a Teku change was under review as of October 27, and Lodestar's change remained open. Glamsterdam had already activated on Sepolia on October 6, but the Hoodi rehearsal and mainnet activation remain unscheduled.
