Dima Gusakov, Head of Engineering at Lido Finance, identified a potential front-running vulnerability affecting delegated staking protocols during the upcoming Ethereum Glamsterdam hard fork. The risk involves the potential for malicious node operators to redirect user ETH deposits by exploiting shared deposit queues.
The vulnerability arises from the introduction of builder deposits with 0xB0 withdrawal credentials in the Glamsterdam upgrade. If an attacker submits a builder deposit that preemptively claims funds intended for a staker’s validator, the validator may fail to activate, and the deposit could be credited to the attacker's account.
The issue was documented in the Ethereum consensus-specs repository as issue #5735, which proposed implementing pre-deposit checks. However, the proposal was closed as 'not planned,' meaning developers will not implement a protocol-level patch. Responsibility for defense now rests with individual staking providers.
Glamsterdam, comprising the Gloas consensus layer and Amsterdam execution layer updates, is scheduled for activation on the Hoodi testnet on October 26, 2026. While a mainnet launch date is not yet set, it is targeted for Q4 2026. Staking providers are encouraged to use the testnet to verify their deposit security pipelines.
