Ethereum developers merged a consensus-layer fix on Oct. 26 addressing a bug in the upcoming Glamsterdam upgrade that could have redirected staking deposits to block builders. The vulnerability, identified by researcher avsetsin through AI-assisted analysis of Lido, Origin, and Rocket Pool deposit handling, would have allowed pending deposits to be sorted incorrectly when a builder used the same key as a validator. No losses have been reported, and existing checks rejecting earlier builder deposits may have prevented exploitation in practice. The proposed fix was initially closed on Oct. 19 due to insufficient client support, per Ethereum consensus specification maintainer Justin Traglia. It was reopened after further review, with additional tests added on Oct. 23 before Traglia merged it Monday. Under the new rules, pending deposits are sorted by withdrawal credentials—the setting determining where a deposit's funds can ultimately go—ensuring validator deposits remain associated with validators regardless of builder key usage. The change is now part of Ethereum's consensus specifications, though client teams must still implement it in their software. Glamsterdam has already run on the Sepolia test network, but its planned Oct. 26 launch on Hoodi, a second test network, was postponed.