Ethereum Fixes the Glamsterdam Bug That Could Have Sent Staking Deposits to Builders
Ethereum developers have patched a flaw in the network's upcoming Glamsterdam upgrade that could have let an operator walk away with ETH that staking services meant for new validators. The fix, which changes the rules for handling validator deposits, was merged on Monday, October 26, a week after developers had turned it down. No losses have been reported, and the episode is a useful reminder of how Ethereum upgrades actually get made: in public, in stages, and sometimes only after an idea is rejected once and argued back into the specification.
What Glamsterdam is trying to do: Glamsterdam splits up two jobs that are bundled together in Ethereum today. Builders bundle transactions into blocks, and validators — who stake ETH to help secure the network — pick and confirm them. Both builders and validators can deposit ETH, and their money is supposed to be tracked separately. Glamsterdam is the biggest upgrade to the Ethereum network since the 2022 Merge, and it has already run on the Sepolia test network. Its launch on a second test network, Hoodi, scheduled for October 26, was postponed, and a new date must be set before a mainnet launch can be scheduled. TradingView's coverage put the expected finalisation of the upgrade by the end of November 2026, but that timetable now depends on the rescheduled Hoodi test.
The bug, in plain language: Researcher avsetsin, listed as a member of Lido's GitHub organisation, found that the draft deposit rules had a gap. If an operator first registered as a builder with a specific public key, and a staking service then deposited ETH using the same key to launch a validator, the draft rules would credit both deposits to the builder. The builder's operator could then withdraw ETH that was meant for the new validator. Avsetsin examined how Lido, Origin and Rocket Pool could be affected, while stressing that the findings depended on how each protocol handles deposits. Crucially, avsetsin described this as a conditional code finding rather than a confirmed live exploit, said existing checks rejecting an earlier builder deposit could stop the attack, and confirmed no losses have been reported. In other words, this was a flaw found in the specification during testing, not funds stolen on mainnet — and the distinction matters for anyone judging how serious it was.
Turned down, then merged: The path to the fix was not smooth. Avsetsin documented the scenario on October 12. Developers closed the proposed fix on October 19, with Justin Traglia, who maintains Ethereum's consensus specifications, writing that there was not enough support from clients to make the change at that time. Clients are the separate software programs validators run to take part in the network, so their support is not a formality — it decides whether a rule change can actually ship. After further review, avsetsin added tests on October 23, the proposal was reopened, and Traglia merged it on Monday. Under the new rules, pending deposits are sorted by their withdrawal credentials — the setting that says where a deposit's money can eventually go — so validator deposits stay with validators even when a builder is using the same key. The change is now part of Ethereum's consensus specifications, but client teams still have to build the revised rules into their software before Glamsterdam can proceed toward mainnet.
Why stakers and holders should care: For everyday ETH holders, this bug would have been invisible — and that is exactly why it matters. Staking services pool user ETH to launch validators, so a deposit-routing error at the protocol level could, in the worst case, put pooled funds in the wrong hands before any user noticed a problem. The fact that it was caught in testing, argued over, and fixed before mainnet is how the system is supposed to work, but it also shows how much of Ethereum's security depends on researchers reading draft specifications closely and on client teams agreeing to implement fixes. ETH traded at $2,330 on October 27 and around $2,352 on October 28, a quiet price backdrop that kept attention on the technical story rather than a market panic. Readers who follow Ethereum's supply side may also want our recent coverage of ETH leaving exchanges at a four-month high: https://zimbuck.com/blogs/237/Ethereum-Is-Leaving-Exchanges-at-a-4-Month-High-Why — exchange outflows and staking deposits are different mechanisms, but both describe holders moving ETH out of immediate saleability and into longer-term positions. For more market news and discussion, follow Zimbuck News at https://zimbuck.com/pages/zimbucknews and join the Zimbuck Market News group at https://zimbuck.com/groups/zimbuckmarketnews.
What happens next: Three things now decide Glamsterdam's timetable. First, client teams must incorporate the revised deposit rules into their software. Second, Hoodi needs a new launch date after its October 26 postponement. Third, the rescheduled testnet run must complete without surfacing another deposit-handling surprise. Only then can a mainnet activation be scheduled with confidence. None of that is guaranteed on a fixed date, and past Ethereum upgrades have slipped for smaller reasons than a rewritten deposit rule. The constructive read is that the process worked: a researcher found a conditional flaw, the specification was corrected, and the fix landed before real funds were at risk. The cautious read is equally fair: an upgrade this large, touching how deposits are credited, deserves exactly this kind of slow, argumentative testing — and holders should treat any end-of-November expectation as a target, not a promise.
FAQ: What was the Glamsterdam bug? Under draft rules, a builder registered with a public key and a later validator deposit using the same key could both be credited to the builder, letting the operator withdraw staking ETH meant for a new validator. Was any ETH lost? No losses have been reported, and the researcher described it as a conditional code finding, not a confirmed live exploit. How was it fixed? Pending deposits are now sorted by withdrawal credentials, so validator deposits remain attributed to the validator. When will Glamsterdam launch on mainnet? Not yet scheduled. Hoodi testnet launch was postponed from October 26, client teams must implement the fix, and a new Hoodi date is needed first.
This article is market news and general information only, not financial advice. Do your own research and speak to a qualified adviser before making any investment decision.
