Ethereum developers have patched a flaw in the planned Glamsterdam upgrade that could have sent ETH meant for new validators to the wrong party.
No losses are reported, and the issue appears only in draft upgrade rules, not on the live Ethereum network that users rely on today.
The fix changes how validator deposits are handled and is now part of Ethereum’s consensus specifications, the shared rulebook that client teams follow when building software.
A researcher known as avsetsin discovered the problem, which emerged during testing of how the network processes deposits that are waiting to be credited.
Glamsterdam separates two jobs that Ethereum currently bundles together. Builders assemble transactions into blocks, while validators stake ETH to confirm them and help secure the network.
Glamsterdam is a major planned overhaul of how Ethereum produces blocks, so even small rule changes attract close scrutiny from client teams and researchers.
That split introduces builder accounts alongside validators, and the bug sits at the point where their deposits meet.
Under the draft rules, an operator could first register as a builder using a specific public key, then wait for a staking service to use the same key.
When the staking service later deposits ETH with that key to activate a validator, the draft rules would credit the funds to the builder instead.
The operator could then withdraw those funds without ever creating a validator, leaving the staking service without the validator it paid to activate.
Avsetsin describes the finding as a conditional code issue rather than a confirmed live exploit, noting that existing checks could block the attack.
The new rules sort deposits by their withdrawal credentials, which keeps validator deposits tied to validators even when a builder reuses the same public key.
The path to the fix is notable. Developers rejected the same change roughly a week earlier, with specification maintainer Justin Traglia saying client support was not yet sufficient.
Client teams must now fold the new rules into their software before Glamsterdam can advance toward a mainnet launch.
Clients are the separate programs that validators run to take part in Ethereum, so coordination across several independent teams will shape the timeline.
Glamsterdam already runs on the Sepolia test network, but the rollout on Hoodi, a second testnet, is delayed with a new date still to be set.
No mainnet release date exists yet, so the upgrade remains in the testing and specification phase for now.
Further testing is expected to follow once client teams finish their implementations and a new Hoodi date is confirmed.
The episode shows the value of that long testing process, since the bug surfaces well before any real ETH is at stake on mainnet.
It also underlines the role of independent researchers, who help catch subtle design problems before upgrades reach production.
Readers following the upgrade should watch for a confirmed Hoodi schedule, which will be the clearest signal of how quickly Glamsterdam moves toward mainnet.
ETH trades near $2,345 on Wednesday, up slightly on the day, as the market focuses mainly on the Federal Reserve’s rate decision.
