Avsetsin, who is listed as a member of Lido’s GitHub organization, looked at how Lido, Origin and Rocket Pool could be affected, in what the researcher called “quick AI research.” The findings depended on how each protocol handles deposits.
“These are conditional code findings, not confirmed live exploits,” avsetsin wrote, adding that existing checks rejecting an earlier builder deposit could stop the attack. No losses have been reported.
Turned down, then merged
Developers closed the proposed fix on Oct. 19. “There was not enough support from clients to make this change at this time,” wrote Justin Traglia, who maintains Ethereum’s consensus specifications. Clients are the separate software programs validators run to take part in the network.
The fix was reopened after further review, avsetsin added tests on Oct. 23, and Traglia merged it Monday.
Under the new rules, pending deposits are sorted by their withdrawal…
