Ethereum ‘Glamsterdam’ Upgrade Could Open New Attack Vector on Delegated Staking, Lido’s Gusakov Says

A new warning has emerged that Ethereum’s next major upgrade, known as Glamsterdam, could open a new attack vector targeting delegated staking services.

On October 20, Lido’s Dima Gusakov wrote on X, formerly Twitter, that the Glamsterdam hard fork is approaching on the Ethereum mainnet and that delegated staking providers and users should be aware of a new attack method.

According to Gusakov, an attacker could act by submitting a separate deposit transaction using the same public key, or pubkey, before a node operator submits a user’s validator deposit transaction. The attack could involve the 0xB0 prefix, which refers to builder withdrawal credentials.

If successful, the validator a user intended to create with deposited Ether could fail to appear. Instead, the deposit could be credited to the builder side using the same public key.

Gusakov added that the attack would only be possible during the Glamsterdam hard-fork transition. Before the upgrade, builder deposits use the existing validator deposit queue. After the upgrade, they will be processed through a separate smart contract.

He said there was no need for excessive concern, adding that staking service providers should be able to prepare countermeasures because the attack window is limited.

He also urged developers and operators of Ethereum-based delegated staking solutions to review the details and prepare mitigation measures before the hard fork takes effect.