One of Ethereum’s consensus clients has merged a fix for an attack targeting the global cache of validator public keys, according to a pull request published on GitHub. The vulnerability affected the Gloas fork, part of the upcoming Glamsterdam upgrade, and could cause some nodes to reject valid signatures and split from the canonical chain. The attack required three pending deposits before the fork, a slashing event and a side chain, making it unlikely to occur by accident. The fix adds keys to the global cache only once their activation eligibility epoch is finalized and introduces a new structure, HeadPubkeys, that combines keys from the head state with those in the cache. It remains to be confirmed whether other consensus clients were affected.
Source: Read the original article
