Ethereum developers have merged a fix for a bug in the upcoming Glamsterdam upgrade that could have allowed operators to divert ETH earmarked for new validators into builder accounts. The patch, finalized on Monday, revises validator deposit processing rules after researchers identified a conditional vulnerability: if an operator first registered as a builder using a specific public key and a staking service subsequently deposited ETH with the same key, the original draft logic would credit both deposits to the builder. Researcher avsetsin confirmed no live exploit or losses occurred, noting existing safeguards already blocked the attack path. The updated rules now sort pending deposits by withdrawal credentials, ensuring validator funds remain properly attributed. Glamsterdam is currently running on the Sepolia testnet, but its scheduled Hoodi testnet launch on October 26 was postponed, requiring a new timeline before mainnet deployment.