Ethereum developers have patched a flaw in the upcoming Glamsterdam upgrade that could have let someone walk off with ETH that staking services meant for new validators.

The fix, which changed the rules for handling validator deposits, was merged Monday, a week after developers turned it down.

Glamsterdam splits up two jobs that are bundled together today. Builders bundle transactions into blocks, and validators, who stake ETH to help secure the network, pick and confirm them. Both can deposit ETH, and their money is supposed to be tracked separately.

The problem appeared during the upgrade itself, when Ethereum would process deposits that were still waiting to be credited.

Researcher Avsetsin identified a scenario in which an operator first registers as a builder using a particular public key, the identifier tied to a validator or builder. If a staking service then deposits ETH to start a validator under that key, the draft rules would credit both deposits to the builder.

“The operator can withdraw the protocol’s funds,” Avsetsin wrote. No validator gets created, so the staking service can’t produce the proof it would need to recover its money.

Avsetsin, listed as a member of Lido’s GitHub organization, examined how Lido, Origin, and Rocket Pool could be affected in what the researcher called “quick AI research.” The findings depended on how each protocol handles deposits.

“These are conditional code findings, not confirmed live exploits,” avsetsin wrote, adding that existing checks rejecting an earlier builder deposit could stop the attack. No losses have been reported.

Source link