The upcoming Glamsterdam upgrade splits block building and validation into separate roles, and both builders and validators can deposit ETH. A researcher found that the draft deposit rules could credit a validator's stake to a builder sharing the same public key.

In that scenario, an operator registers as a builder first, then a staking service deposits ETH for a new validator under the same key. Both deposits go to the builder, no validator is created, and the staking service has no proof to recover its funds. Lido, Origin and Rocket Pool were reviewed as potentially exposed, with the findings described as conditional, not confirmed live exploits.

No losses have been reported, and the fix was merged into the consensus specs on Monday, a week after it was first closed for lack of client support.

Under the new rules, pending deposits are sorted by withdrawal credentials, so validator deposits stay with validators. Client teams still need to implement the change. Glamsterdam has already run on Sepolia, but its Oct. 26 launch on the Hoodi testnet was postponed.