Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders

What it is

A flaw in the draft Glamsterdam deposit rules on Ethereum. Pending deposits were credited by public key, so a builder deposit and a validator deposit sharing a key could both be credited to the builder. The consensus-spec fix was merged on 26 October 2026 by Justin Traglia, who maintains the consensus specifications. Client teams still have to implement it.

How it works

The flaw appeared when the upgrade processed deposits still waiting to be credited. The researcher avsetsin described this sequence:

1. An operator registers as a builder under a given public key.
2. A staking service then deposits ETH to start a validator under the same key.
3. The draft rules credit both deposits to the builder.
4. No validator is created, so the service cannot produce the proof it needs to recover its funds.

Under the new rules, pending deposits are sorted by withdrawal credentials. Validator deposits stay with validators even when a builder uses the same key.

Preconditions / Affected

Avsetsin, listed as a member of Lido's GitHub organization, looked at how Lido, Origin and Rocket Pool could be affected. The result depended on how each protocol handles deposits. Avsetsin called the work "quick AI research" and said the findings were "conditional code findings, not confirmed live exploits".

What to do

Staking protocol and client engineers should track the revised deposit rules in the consensus specifications and check how their own deposit flow handles a public key that is already registered as a builder. The page gives no commands or version numbers.

Caveats

• Avsetsin noted that existing checks which reject an earlier builder deposit could stop the attack.
• No losses have been reported.
• The fix was closed on 19 October because "there was not enough support from clients to make this change at this time". It was reopened after review, avsetsin added tests on 23 October, and it was merged on 26 October.
• Glamsterdam has run on the Sepolia test network. Its 26 October launch on the Hoodi test network was postponed, and it needs a new Hoodi date before a mainnet launch can be scheduled.