WORLDTECHEthereum clients patch flaw that could misdirect validator ETH deposits
Ethereum client teams have closed a flaw in the draft rules for Glamsterdam, the network's upcoming upgrade, that could have let attackers redirect ETH intended for new validators. According to Crypto Briefing, the bug was fixed before any coins were lost, but the case shows how much depends on the separation of roles the upgrade is meant to formalise.
How the flaw was found and fixed
A researcher who goes by avsetsin reported the vulnerability. It concerned the draft rules for ePBS, short for enshrined proposer-builder separation, which forms a core piece of the Glamsterdam upgrade.
Under those draft rules, deposits could be credited to a builder account by mistake whenever builder and validator activity shared one public key. Staking, which locks up tokens to help run a network in return for a reward, is the activity involved. The correction changes how deposits are sorted: the revised protocol routes them according to withdrawal credentials rather than relying on public keys alone.
A fix that nearly stalled
The patch did not pass on its first attempt. It was initially rejected on October 19, 2026, because it lacked sufficient client support. Maintainer Justin Traglia later merged it into the consensus specifications between October 23 and October 28, 2026.
The update has already been exercised on testnets, with mixed scheduling results. Hoodi, another Ethereum testnet, saw its activation postponed after the fix.
Why the upgrade raises the stakes
Glamsterdam is designed to formally separate the roles of block builders and validators. Today that separation largely happens outside the core protocol, so moving it inside marks a significant shift in how Ethereum's protocol is assembled.
Separately, the Ethereum client developers Teku and Besu have released security updates for a certificate weakness that could let attackers pose as services validators rely on, potentially diverting their block rewards.
Open questions
- Will the revised deposit routing run without scheduling problems on the remaining testnets?
- When is the Glamsterdam upgrade expected to reach the main network?