The Glamsterdam upgrade, which separates the roles of builders (who bundle transactions) and validators (who stake ETH to secure the network), was found to contain a flaw affecting how deposits are credited. Researcher Avsetsin, associated with Lido's GitHub organisation, identified a scenario in which an operator could register as a builder using a given public key. If a staking service then deposited ETH to start a validator under the same key, the draft rules would credit both deposits to the builder. 'The operator can withdraw the protocol's funds,' Avsetsin wrote. No validator would be created, leaving the staking service unable to recover its money.
Avsetsin examined potential consequences for Lido, Origin and Rocket Pool in what they described as 'quick AI research,' stressing that findings were conditional and that existing checks could prevent the attack. No losses have been reported.
The proposed fix was initially closed on Oct. 19. 'There was not enough support from clients to make this change at this time,' wrote Justin Traglia, who maintains Ethereum's consensus specifications. After further review and additional tests, Traglia merged the fix on Monday. Under the new rules, pending deposits are sorted by withdrawal credentials, ensuring that validator deposits remain with validators even if a builder uses the same key.
Client teams must now incorporate the revised deposit rules. Glamsterdam had already run on the Sepolia test network, but its Oct. 26 launch on Hoodi, a second test network, was postponed. A new Hoodi date must be set before a mainnet launch can be scheduled.