Lido Engineers Warn of Staking Deposit Hijacking Risk in Glamsterdam

The head engineer of the Ethereum liquid staking protocol Lido, Dmitry Gusakov, warned at the developer conference ACDC #189 that the one-time builder access mechanism introduced by the Glamsterdam upgrade could interfere with the deposit protection logic of the staking protocol, leading to the hijacking of staking deposits. This issue involves multiple deposits sharing the same validator public key. According to Ethereum's current deposit rules, the first valid deposit will determine the withdrawal credential, and staking protocols typically leverage this feature to prevent credential manipulation, such as initially depositing a small amount of ETH and then topping up the remaining funds once the expected credential appears. However, the special access mechanism introduced by Glamsterdam may alter the interpretation of subsequent pending deposits under the same public key during the fork transition period, causing the deposited ETH to be credited to the builder's account. Lido's proposed fix is to maintain a distinction between validator deposits and builder deposits during the one-time access process, but core developers rejected this modification due to timing issues. The main reason is that the Sepolia testnet has already been activated according to existing specifications, and the Hoodi client version is also in preparation; changing behavior at this time may require redeploying Sepolia and conducting additional testing. This issue affects the access process during the fork transition period rather than the ongoing deposit processing rules, but its consequences could impact deposits waiting in the queue.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.