Ethereum developers merge a fix for a Glamsterdam bug that could have let a builder claim staking deposits, as the next testnet date slips

Ethereum developers have fixed a bug in Glamsterdam, the upgrade that separates block builders from validators. Under the draft rules, if an operator first registered a builder with a public key, a staking service that later deposited ETH to start a validator under the same key would see both deposits credited to the builder. No validator would be created, and the service could not produce the proof needed to recover its funds, CoinDesk reported.

Unchained said George Avsetsin, Lido's chief protocol architect, reported the bug on October 12 and wrote the fix. Justin Traglia, who maintains the consensus specifications, closed it on October 19 for lack of client support, then merged it on October 26 after it was reopened on October 23. The fix checks each pending deposit's withdrawal credentials, so validator deposits stay with validators. Avsetsin described the findings as "conditional code findings, not confirmed live exploits," and no losses have been reported.

Work remains. Prysm developer Potuz approved the change but asked for more testing, Unchained said, while a Lodestar branch passes the new tests. A new Hoodi date is needed before a mainnet launch can be scheduled.