Ethereum clients patch vulnerability to prevent ETH reward redirection

A flaw in draft Glamsterdam rules could have sent new validator deposits to builder accounts, but it was fixed before any funds were lost Ethereum clients have patched a flaw that could have let attackers redirect ETH meant for new validators. The bug lived in the draft rules for Glamsterdam, the network’s upcoming upgrade, and it was fixed before anyone lost a single coin. What went wrong in the draft rules The vulnerability was reported by a researcher who goes by avsetsin. It involved the draft rules for ePBS, short for enshrined proposer-builder separation, a core piece of the Glamsterdam upgrade. In this case, the shared identifier was a public key. Under the draft rules, when builder and validator activity used the same public key, staking deposits could be credited to a builder account by mistake. The fix changes how deposits get sorted. Instead of leaning only on public keys, the revised protocol routes deposits based on withdrawal credentials. A fix that almost did not make it The patch did not sail through on its first attempt. It was initially rejected on October 19, 2026, because it lacked sufficient client support. After reassessment, the change came back. Maintainer J...