TREE NEWS update: Ethereum developers have fixed a flaw in the Glamsterdam upgrade that could have let operators claim ETH that staking services deposited to launch new validators. Researcher avsetsin found draft rules might credit both deposits to a builder account if an operator registered as a builder with a specific public key and a staking service later used the same key. The fix, merged Monday, sorts pending deposits by withdrawal credentials so validator deposits stay with validators; no losses were reported.
Ethereum devs patch Glamsterdam flaw that could misdirect staked ETH to builders
The episode highlights a structural risk in Ethereum's builder-operator overlap: staking services and block builders share key space in ways that draft upgrade rules did not fully anticipate. The exposure was caught in review rather than in production, but it points to how much of staking safety now depends on speculative edge-case testing before hard forks ship. With no losses reported, the practical question is whether similar key-reuse scenarios exist in other parts of the Glamsterdam spec, and how much scrutiny the remaining draft rules receive before activation.
Generated by AI for reference only.
Share on WeChat
Open WeChat → Scan → then tap "…" to send to a chat or Moments.
Tap "…" in the top-right corner to send to a chat or share to Moments.