Lido engineering lead Dmitry Gusakov warned at developer meeting ACDC #189 that Glamsterdam’s one-time builder onboarding mechanism could disrupt existing safeguards for staking deposits and expose them to hijacking when multiple deposits share a validator public key. According to ChainCatcher, current Ethereum rules let the first valid deposit determine withdrawal credentials, a feature staking protocols use to prevent credential manipulation by initially depositing a small amount of ETH and adding the remainder after the validator appears with the expected credentials.

During the fork transition, Glamsterdam’s special onboarding mechanism could change how later pending deposits under the same public key are interpreted, creating a third possible outcome: the validator does not appear, and the deposited ETH is credited to the builder. Lido proposed preserving the distinction between validator and builder deposits during one-time onboarding, but core developers rejected the change on timing grounds. Sepolia has already activated under the existing specification, and a Hoodi client release is in preparation; changing the behavior now could require redeploying Sepolia and conducting additional tests. The issue is limited to the transition-period onboarding process rather than ongoing deposit handling, but could affect deposits waiting in the queue.