Patch Released for Ethereum Gloas Fork

A fix has been merged for a vulnerability in one of Ethereum's consensus clients that could lead to the poisoning of the validator public key cache. The patch addresses a bug that caused some nodes to reject valid signatures around the Gloas fork. The bug stems from the way the client stores validators' public keys in a global cache. Gloas constitutes the consensus layer part of Ethereum's planned Glamsterdam upgrade. The patch anticipates the addition of keys after the activation eligibility period for the global public key cache is finalized. The attack scenario requires three pending investments just before the fork. One of these investments adds a large balance to an existing validator, while the other two involve new keys. The large balance addition on the main chain consumes the balance flow, and the validator with the added balance on the attacker's side gets penalized before the fork. The faulty cache logic was based on the assumption that both chains would produce the same validators. Developers note that executing the attack is difficult. As the Glamsterdam upgrade approaches, similar scenarios that may arise at the fork boundary are being examined.