A flaw in draft Glamsterdam rules could have sent new validator deposits to builder accounts, but it was fixed before any funds were lost
Ethereum clients have patched a flaw that could have let attackers redirect ETH meant for new validators. The bug lived in the draft rules for Glamsterdam, the network’s upcoming upgrade, and it was fixed before anyone lost a single coin.
What went wrong in the draft rules
The vulnerability was reported by a researcher who goes by avsetsin. It involved the draft rules for ePBS, short for enshrined proposer-builder separation, a core piece of the Glamsterdam upgrade.
In this case, the shared identifier was a public key. Under the draft rules, when builder and validator activity used the same public key, staking deposits could be credited to a builder account by mistake.
The fix changes how deposits get sorted. Instead of leaning only on public keys, the revised protocol routes deposits based on withdrawal credentials.
A fix that almost did not make it
The patch did not sail through on its first attempt. It was initially rejected on October 19, 2026, because it lacked sufficient client support.
After reassessment, the change came back. Maintainer Justin Traglia merged it into the consensus specifications between October 23 and October 28, 2026.
The update has already been exercised on testnets, with mixed scheduling results. The Sepolia testnet successfully executed it.
Hoodi, another Ethereum testnet, saw its activation postponed after the fix.
Why Glamsterdam raises the stakes
Glamsterdam is designed to formally separate the roles of block builders and validators. That is a significant shift in how Ethereum’s protocol is put together.
Today, the separation between the party that assembles blocks and the party that proposes them largely happens outside the core protocol. ePBS aims to bake that division directly into Ethereum’s rules.
This bug sat right on one of those seams. Builders and validators were becoming distinct entities, yet the draft rules still allowed them to be confused when they shared a key.
What this means for stakers and the upgrade path
For anyone staking ETH or planning to spin up a validator, the immediate takeaway is reassuring. No funds were lost, and the corrected deposit logic now keys off withdrawal credentials rather than public keys alone.
The initial rejection is also worth noting. It shows that Ethereum’s multi-client governance can slow down even clearly beneficial fixes when not every team is ready.
What to watch next is the Hoodi rescheduling and any further revisions to the ePBS specification.
