Ethereum Patches Glamsterdam Flaw That Could Divert Staking Deposits
Baca dalam 60 detik
- Pengembang Ethereum menutup celah pada spesifikasi Glamsterdam yang berpotensi membuat dana setoran validator jatuh ke tangan builder.
- Perbaikan sempat ditolak pekan lalu karena minim dukungan klien, lalu diterima setelah pengujian tambahan atas temuan peneliti.
- Peluncuran Glamsterdam di mainnet masih menunggu jadwal baru uji coba Hoodi yang sebelumnya ditunda.
Ethereum developers have officially patched a security flaw in the specification for the Glamsterdam upgrade that, if left unaddressed, could have moved deposit funds belonging to staking services to builders. The fix was merged on Monday (27/10/2026), a week after a similar proposal was rejected in the development forum.
Glamsterdam separates two roles that have so far been fused: builders who assemble transactions into blocks, and validators who deposit ETH to secure the network and confirm blocks. Both may deposit ETH, but accounting rules require separate records. The flaw emerged precisely during the upgrade's transition phase, when Ethereum processes deposits still waiting to be credited.
A researcher listed under the Lido GitHub organization, Avsetsin, mapped the attack scenario: an operator registers as a builder with a specific public key, then a staking service deposits ETH to create a validator with the same key. Under the rule design at the time, both deposits were credited to the builder. "The operator can withdraw the protocol's funds," Avsetsin wrote. Because the validator was never created, the staking service lacks the proof needed to recover its funds.
Avsetsin stressed that the finding was conditional, not an exploit that had already occurred on a live network. A check that rejects builder deposits was said to be able to thwart the attack. As of publication, no losses had been reported. Nevertheless, the incident shows that separating the builder and validator roles—the core of Glamsterdam's design—leaves an accounting gap that must be closed before mainnet.
"There wasn't enough client support to make this change at the time," said Justin Traglia, maintainer of the Ethereum consensus specification, as quoted from development notes.
The initial rejection on 19 October delayed the fix. After a review, Avsetsin added tests on 23 October, and Traglia merged the change four days later. The new rule orders pending deposits by withdrawal credentials—the setting that determines where funds can ultimately be withdrawn. That way, validator deposits remain recorded as belonging to the validator even if a builder uses the same key.
The change currently applies only at the consensus specification level. Client teams still have to implement it in the software validators run. Glamsterdam itself has passed Sepolia, but its launch on Hoodi—the second test network—was postponed from the 26 October schedule. Without a new date for Hoodi, a mainnet launch cannot yet be scheduled.
For the Ethereum ecosystem, the case is a reminder that major upgrades always bring new risks at the consensus layer. For the global cryptocurrency market, including investors in Indonesia tracking digital assets, certainty over the Glamsterdam schedule will shape expectations about transaction costs and network efficiency. The question now: can client teams catch up on implementing this fix without pushing the Hoodi and mainnet schedules further out?
