Ethereum developers have successfully patched a critical vulnerability within the draft specifications for the upcoming Glamsterdam network upgrade. The flaw, identified by researcher avsetsin, could have allowed for the misdirection of staking deposits intended for new validators to builder accounts.
The issue stemmed from the draft rules for enshrined proposer-builder separation (ePBS), where the system incorrectly relied on public keys to identify participants. If a builder and a validator shared the same public key, the protocol could have erroneously credited staking funds to the builder.
The fix replaces the public key reliance with a mechanism based on withdrawal credentials to ensure accurate deposit routing. While an initial patch attempt was rejected on October 19, 2026, due to insufficient client support, the final update was merged into consensus specifications by maintainer Justin Traglia between October 23 and October 28, 2026.
The corrected protocol logic has already undergone testing on the Sepolia testnet. The Glamsterdam upgrade itself aims to formally integrate the separation of block builders and validators directly into the Ethereum core protocol, moving away from current off-protocol arrangements.
