Lido engineer flags deposit front-running risk ahead of Ethereum's Glamsterdam fork
In brief
- Lido's Dima Gusakov flagged a potential Glamsterdam-linked deposit front-running risk on October 20.
- Builder deposits with 0xB0 credentials will share deposit queues with validator deposits around the fork, Gusakov warned.
- Consensus-specs issue #5735, which proposed pre-deposit checks, was closed as "not planned," Crypto Briefing reported.
- Glamsterdam is scheduled for Hoodi testnet on October 26, with mainnet targeted for Q4 2026, per Crypto Briefing.
How the deposit hijack would work
Glamsterdam pairs two upgrades: Gloas, which covers the consensus layer, and Amsterdam, which covers the execution layer. It also introduces builder deposits that use withdrawal credentials marked with the 0xB0 prefix.
That's the problem.
According to Gusakov's warning, builder deposits and validator deposits will run through shared deposit queues around the fork. A malicious node operator with the right access could submit a builder deposit that preemptively claims ETH meant for a staker's validator. If the attack succeeded, the deposit would be credited to the attacker's builder account (and the validator the staker was funding would never activate).
It's a potential risk, not an exploit that's happened. Crypto Briefing reported the vulnerability is specific to the pre-fork phase and isn't a permanent flaw in Ethereum's design.
Burden shifts to staking protocols
The issue was raised in the Ethereum consensus-specs repository on GitHub as issue #5735, which proposed pre-deposit checks. Crypto Briefing reported that it was closed as "not planned," and the outlet read the closure as core developers leaving this defense to the application layer. Gusakov pointed to pre-deposit checks as the defense, with the burden on staking protocols rather than the core specification.
Lido has dealt with this kind of threat before. After deposit front-running vulnerabilities came to light in 2021, it built a Deposit Security Module and a guardian committee to oversee deposits; under that model, a group of guardians checks that nothing suspicious has slipped in ahead of deposits before they go through.
Does that setup account for the new 0xB0 builder credentials and shared queue dynamics? Crypto Briefing called it an open question for existing deposit safeguards. The outlet also assessed that smaller or newer staking services without comparable checks may need to move quickly before mainnet activation.
Hoodi testnet comes first
Crypto Briefing reported the upgrade is scheduled to activate on the Hoodi testnet on October 26, six days after Gusakov's warning. A mainnet date hasn't been set, though the launch is targeted for Q4 2026.
That gives staking teams a window. They can use Hoodi to test whether their deposit pipelines detect and block a builder deposit that tries to claim validator funds, before any of this touches mainnet ETH.
Frequently asked questions
What staking deposit risk did Lido's Dima Gusakov flag for Glamsterdam?
Gusakov flagged a potential front-running attack on delegated staking protocols during the transition to Glamsterdam. According to his warning, builder deposits and validator deposits will share deposit queues around the fork. That would let a malicious node operator with the right access submit a builder deposit that preemptively claims ETH meant for a staker's validator.
Is the Glamsterdam deposit risk a permanent flaw in Ethereum?
No. Crypto Briefing reported that the vulnerability is specific to the pre-fork phase and isn't a permanent flaw in Ethereum's design. It's a potential risk Gusakov flagged, not an exploit that has happened.
How can staking protocols defend against builder deposit front-running?
Gusakov pointed to pre-deposit checks as the defense, with the burden on staking protocols rather than the core specification. Crypto Briefing reported that consensus-specs issue #5735, which proposed such checks, was closed as "not planned." Staking teams can use the Hoodi testnet to check whether their deposit pipelines detect and block these builder deposits.
When does Glamsterdam activate?
Crypto Briefing reported that Glamsterdam is scheduled to activate on the Hoodi testnet on October 26, 2026. A mainnet date hasn't been set, though the launch is targeted for Q4 2026.
