Only reset builder withdrawal epoch if its balance has been swept - #5384
Merged
Conversation
… swept @Mushow raised a point on discord that an attacker could continuely deposit 1 ETH every `MIN_BUILDER_WITHDRAWABILITY_DELAY` epochs to prevent a builder from getting their balance back. One solution to this would be to only reset the withdrawalable epoch on top-ups if the balance has already been swept. This guarantees that the builder will get their balance back & prevents the original attack which this block of code prevented. See the following for more details: * ethereum#5373 Big thanks to @Mushow for recognizing this!
jihoonsong
reviewed
Jun 24, 2026
nflaig
approved these changes
Jun 24, 2026
jtraglia
enabled auto-merge (squash)
June 24, 2026 18:40
nflaig
pushed a commit
to ChainSafe/lodestar
that referenced
this pull request
Jul 7, 2026
etan-status
added a commit
to status-im/nimbus-eth2
that referenced
this pull request
Jul 8, 2026
tersec
pushed a commit
to status-im/nimbus-eth2
that referenced
this pull request
Jul 8, 2026
* use v1.7.0-alpha.12 consensus reference tests * Reduce `MAX_BUILDER_DEPOSIT_REQUESTS_PER_PAYLOAD` to 64 - ethereum/consensus-specs#5420 * Remove `MAX_DEPOSIT_REQUESTS_PER_PAYLOAD` in Gloas - ethereum/consensus-specs#5436 * Add the IL bitlist to bid - ethereum/consensus-specs#5410 * Fix some inconsistencies in fulu partial-columns spec - ethereum/consensus-specs#5357 * Restrict builder deposits to payload builders - ethereum/consensus-specs#5439 * Only reset builder withdrawal epoch if its balance has been swept - ethereum/consensus-specs#5384 * Set `BUILDER_WITHDRAWAL_PREFIX` to 0xB0 - ethereum/consensus-specs#5416 * Reduce `MIN_BUILDER_WITHDRAWABILITY_DELAY` to 64 epochs - ethereum/consensus-specs#5426 * Re-generate test reports * Fix test_light_client_processor * Fix block_sim * Drop duplicate import * Fix resttest
Merged
12 tasks
tersec
pushed a commit
to status-im/nimbus-eth2
that referenced
this pull request
Jul 9, 2026
* Forward compatible consensus data structures (EIP-7688) - EIP https://eips.ethereum.org/EIPS/eip-7688 - Spec ethereum/consensus-specs#4630 - Tests ethereum/consensus-specs#4630 (comment) - Kurtosis ethereum/consensus-specs#4630 (comment) * ForkedAggregate cleanup * Sync gossip checks * Cleanups * Resttest * Focil test * Progressive for PayloadAttestation, ExecutionPayloadBid, Envelope * Use mapIt * Heze constants * use v1.7.0-alpha.12 consensus reference tests (#8729) * use v1.7.0-alpha.12 consensus reference tests * Reduce `MAX_BUILDER_DEPOSIT_REQUESTS_PER_PAYLOAD` to 64 - ethereum/consensus-specs#5420 * Remove `MAX_DEPOSIT_REQUESTS_PER_PAYLOAD` in Gloas - ethereum/consensus-specs#5436 * Add the IL bitlist to bid - ethereum/consensus-specs#5410 * Fix some inconsistencies in fulu partial-columns spec - ethereum/consensus-specs#5357 * Restrict builder deposits to payload builders - ethereum/consensus-specs#5439 * Only reset builder withdrawal epoch if its balance has been swept - ethereum/consensus-specs#5384 * Set `BUILDER_WITHDRAWAL_PREFIX` to 0xB0 - ethereum/consensus-specs#5416 * Reduce `MIN_BUILDER_WITHDRAWABILITY_DELAY` to 64 epochs - ethereum/consensus-specs#5426 * Re-generate test reports * Fix test_light_client_processor * Fix block_sim * Drop duplicate import * Fix resttest
tbenr
added a commit
to rolfyone/teku
that referenced
this pull request
Jul 9, 2026
tbenr
added a commit
to rolfyone/teku
that referenced
this pull request
Jul 9, 2026
ensi321
added a commit
to ChainSafe/lodestar
that referenced
this pull request
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@0xMushow raised a point on discord that an attacker could continuely deposit 1 ETH every
MIN_BUILDER_WITHDRAWABILITY_DELAYepochs to prevent a builder from getting their balance back. One solution to this would be to only reset the withdrawalable epoch on top-ups if the balance has already been swept. This guarantees that the builder will get their balance back & prevents the original attack which this block of code prevented. See the following for more details:Big thanks to @0xMushow for recognizing this!