Ethereum developers merged a fix for a flaw in the upcoming Glamsterdam upgrade that could have let an operator withdraw ETH meant for new validators. The change came a week after developers first turned it down. Client teams still have to build it in, and Glamsterdam needs a new Hoodi test network date.
Ethereum developers have patched a flaw in the upcoming Glamsterdam upgrade that could have let someone walk off with ETH that staking services meant for new validators. The fix, which changed the rules for handling validator deposits, was merged Monday, a week after developers turned it down.
Glamsterdam splits up two jobs that are bundled together today. Builders put blocks of transactions together, while validators, who stake ETH to help secure the network, pick and confirm them. Both can deposit ETH, and the protocol is supposed to track their money separately.
How the money could go missing
The problem appeared when Ethereum would process deposits that were still waiting to be credited. Researcher avsetsin identified a scenario in which an operator first registers as a builder with a particular public key. If a staking service then deposits ETH to start a validator under that key, the draft rules would credit both deposits to the builder.
No validator gets created in that case, so the staking service cannot produce the proof it would need to recover its money. Avsetsin looked at how Lido, Origin and Rocket Pool could be affected.
The findings depended on how each protocol handles deposits, and existing checks that reject an earlier builder deposit could stop the attack. No losses have been reported.
Turned down, then merged
Developers closed the proposed fix on Oct. 19. According to Justin Traglia, who maintains Ethereum's consensus specifications: "There was not enough support from clients to make this change at this time."
The fix was reopened after further review, avsetsin added tests on Oct. 23, and Traglia merged it Monday. Under the new rules, pending deposits are sorted by their withdrawal credentials, and validator deposits stay with validators even if a builder uses the same key.
Client teams still have to build the change into their software. Glamsterdam has already run on the Sepolia test network, but its Oct. 26 launch on Hoodi, a second test network, was postponed, and it needs a new Hoodi date before a mainnet launch can be scheduled.
Source: CoinDesk
Trading involves risk.
Risk Disclaimer
