Ethereum core developers officially merged a consensus specification fix on Monday, Oct. 26, 2026. The move was taken to address a serious vulnerability in the planned Glamsterdam hard fork upgrade before the code is deployed to the mainnet. If left unpatched, the consensus system could mistakenly attribute validator deposit funds to another party.
A researcher named Avsetsin from Lido’s GitHub organization first uncovered the vulnerability while investigating scenarios involving the separation of roles between block-producing builders and transaction-confirming validators. In the early draft of the Glamsterdam rules, an issue arose when an operator registered as a builder using a specific public key. If a staking protocol subsequently deposited ETH to activate a validator under that same public key, the consensus system would mistakenly credit the validator deposit to the builder.
The logical flaw in the draft rules could potentially allow builder operators to withdraw the staking protocol’s ETH deposits without a new validator ever being created. That situation would cause staking protocols to lose their claim over the deposited funds. Major liquid staking protocols such as Lido, Origin, and Rocket Pool were identified as potentially affected by this scenario. However, developer reports confirmed that no live-network exploits or financial losses have occurred.
Initially Rejected Before Comprehensive Testing
The proposed consensus fix faced hurdles before finally gaining consensus approval. Consensus maintainer Justin Traglia had previously closed the pull request on Oct. 19, 2026, due to limited support from client development teams. Discussions on the fix were only reopened after comprehensive testing was formally submitted on Oct. 23, 2026.
The newly approved rules separate deposit queues based on withdrawal credentials. This mechanism ensures that validator deposits remain isolated and secure even if a builder uses an identical public key. The queue separation guarantees that deposited funds remain directed toward validator creation without the risk of being redirected to a builder’s account.
Hoodi Testnet Launch Rescheduled
The Glamsterdam upgrade had previously undergone successful testing on the Sepolia testnet without technical issues. However, the discovery of the deposit flaw impacted the timeline for subsequent trials. The planned deployment on the Hoodi testnet, originally targeted for Oct. 26, 2026, was rescheduled before a mainnet launch date could be determined.
The rescheduling on Hoodi provides client development teams with time to ensure full alignment with the updated consensus specifications. For liquid staking protocols and ETH depositors, this consensus-level patch ensures the safety of funds before Glamsterdam goes live on the production network.
Reported by CoinDesk.
Also read: How Crypto Staking Works and Its Risks
Previously: Glamsterdam Hard Fork on Hoodi Testnet Postponed - Gas Flaws in Two EIPs Leave Mainnet Release in Limbo
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
