Vulnerability Fix: Ethereum Adjusts Glamsterdam Deposit Rules

Odaily: Ethereum developers have fixed a vulnerability in the Glamsterdam upgrade. The vulnerability could have allowed operators to take ETH that staking services had originally intended to use to launch new validators. Researcher avsetsin discovered that if an operator first registers as a builder with a specific public key, and the staking service subsequently uses the same key to deposit ETH to launch a validator, the draft rules could credit both deposits to the builder's account. avsetsin said this was a conditional code discovery, not a confirmed real-time exploit; existing checks can prevent the attack, and no losses have been reported. The fixed rules sort pending deposits by withdrawal credentials, so validator deposits still belong to the validator. The change was merged on Monday, after developers had rejected it a week earlier.