Ethereum developers patch deposit-routing flaw in Glamsterdam upgrade

The flaw, initially identified by researcher avsetsin on October 12, concerned the network's transition rules during the Gloas fork. Under the original proposed logic for enshrined proposer-builder separation, a builder could potentially intercept staking deposits if both the builder and the validator utilized the same public key. This scenario posed a risk for liquid staking protocols, where an operator could gain control over funds intended for a new validator by registering as a builder first.

While developers initially rejected the proposed correction on October 19 due to a lack of consensus support, they reversed course four days later following additional testing. Maintainer Justin Traglia finalized the merge after developer avsetsin included specific test cases to handle overlapping key scenarios. This update is strictly a specification change; individual consensus client teams must now integrate these rules and conduct their own testing before the upgrade reaches the mainnet. The deposit issue remains independent of the separate EIP-8037 compatibility risks that recently forced the postponement of the Glamsterdam upgrade on the Hoodi testnet.