From CoinDesk · By Shaurya Malwa
Ethereum developers patched a flaw in the upcoming Glamsterdam upgrade that could have allowed an operator to withdraw ETH intended for new validators.
The vulnerability involved builder and validator deposits sharing a public key, potentially crediting both deposits to the builder and leaving staking services unable to recover their funds.
No losses have been reported, and client teams must now incorporate the revised deposit rules before Glamsterdam can proceed toward a mainnet launch.
Ethereum developers have patched a flaw in the upcoming Glamsterdam upgrade that could have let someone walk off with ETH that staking services meant for new validators.
The fix, which changed the rules for handling validator deposits, was merged Monday, a week after developers turned it down.
Glamsterdam splits up two jobs that are bundled together today. Builders put blocks of transactions together, and validators, who stake ETH to help secure the network, pick and confirm them. Both can deposit ETH, and their money is supposed to be tracked separately.
How the money could go missing
The problem appeared during the upgrade itself, when Ethereum would process deposits that were still waiting to be credited.
Researcher avsetsin identified a scenario in which an operator first registers as a builder using a particular public key, the identifier tied to a validator or builder. If a staking service then deposits ETH to start a validator under that key, the draft rules would credit both deposits to the builder.
“The operator can withdraw the protocol’s funds,” avsetsin wrote. No validator gets created, so the staking service can’t produce the proof it would need to recover its money.
Avsetsin, who is listed as a member of Lido’s GitHub organization, looked at how Lido, Origin and Rocket Pool could be affected, in what the researcher called “quick AI research.” The findings depended on how each protocol handles deposits.
“These are conditional code findings, not confirmed live exploits,” avsetsin wrote, adding that existing checks rejecting an earlier builder deposit could stop the attack. No losses have been reported.
Turned down, then merged
Developers closed the proposed fix on Oct. 19. “There was not enough support from clients to make this change at this time,” wrote Justin Traglia, who maintains Ethereum’s consensus specifications. Clients are the separate software programs validators run to take part in the network.
The fix was reopened after further review, avsetsin added tests on Oct. 23, and Traglia merged it Monday.
Under the new rules, pending deposits are sorted by their withdrawal credentials, the setting that says where a deposit’s money can eventually go. Validator deposits stay with validators even if a builder is using the same key.