Ethereum clients patch flaw that could redirect ETH rewards
The most delegated contract in my EIP-7702 sample ends in these 12 bytes: a164736f6c6343000822000a. Most Solidity contracts built with default settings end in 53. The longer tail is a small CBOR map the compiler appends to the bytecode: an IPFS hash of the contractβs metadata file, the compiler version, and two bytes giving the mapβs length. This one has the version and noΒ hash.
On 8 September I pulled every EIP-7702 authorization from a 200-block window on Ethereum mainnet, 1,178 of them, and read the bytecode of the 59 contracts they delegated to. Nine of those authorizations pointed at the zero address, which is how an account undelegates, so 1,169 went to real code. When I went back over the 59 on 11 October, ten had the short tail. I left a note beside them: no metadata hash, so maybe nobody meant the source to beΒ found.
Read as CBOR, a1 opens a map with one entry, 64 says a four-byte string follows (solc), and 43 says a three-byte value follows: 00 08 22, which is version 0.8.34. The last two bytes, 00 0a, give the length of everything before them, ten. So the compiler version survives. Whatβs gone is the hash that would let anyone fetch the exact metadata file, the one that lists every source fileβs own hash and the compiler settings. In solc thatβs a single setting, metadata.bytecodeHash set to none, and Foundry exposes it as bytecode_hash.

Today I asked Blockscoutβs API whether each of the 59 has verified source, and asked Sourcify the same. Nine of the ten stripped contracts are verified on Blockscout. Of the 46 that kept the full hash, 21 are. The other three have no CBOR tail at all, and one of those is verified.
Counting authorizations instead of contracts widens the gap. In that September window, 369 of the 371 authorizations to stripped delegates went to a contract with published source. For the full-hash contracts it was 324 of 774, aboutΒ 42%.

The one stripped contract with no source, 0xbaa66503..., drew two authorizations. The second most delegated contract in the whole sample, 0x67b743f3... with 144, carries a full IPFS hash and has no verified source on either service. Neither does 0x912518c2... with 96. Three unverified contracts of 2,140 bytes each carry the same IPFS hash, so theyβre one build deployed threeΒ times.
The nine verified ones carry six contract names: Uniswapβs CaliburEntry at three addresses, Alchemyβs SemiModularAccount7702 at two, two TokenPocket delegators, UniversalGaslessDelegate, and the most delegated contract of all, with 308 of the windowβs authorizations, whose verified source names it Poisoner.

Caliburβs foundry.toml and the one in Alchemyβs modular-account repository both set bytecode_hash = "none" as the project default. Neither file says why. Five of the ten addresses look mined: two start with eight zeros, one with 0x0000fb7702, one with 0x69007702, and one starts 0x77021100 and ends 0000. The metadata hash changes whenever a comment or a file path changes, even when the compiled code doesnβt, and an address found by searching CREATE2 salts depends on the exact bytecode. Dropping the hash ties the bytecode to the code alone. Thatβs my reading of the reason, not something either projectΒ says.
Sourcify answered for eight of the stripped contracts, and all eight came back as match, none as exact_match. Of the full-hash contracts it has, 13 of 17 are exact. Sourcifyβs docs say an exact match rests on the metadata hash in the deployed code agreeing with the recompiled one, which is how it proves the source files are byte for byte the ones the author compiled. With no hash in the bytecode thereβs nothing for that check to hold on to, so Iβd expect every stripped contract to stop at match, whoever wroteΒ it.
The authorization counts come from one 200-block window in September, so they say which delegates were busy then. Verified means Blockscoutβs flag and Sourcifyβs record as I read them on 27 October. I didnβt check Etherscan, which wants an API key, and a contract could be verified there and nowhere else. I also tried two public IPFS gateways for the hashes on the unverified contracts and both refused the requests, so I canβt say whether any of those metadata files exist somewhere.
Ten EIP-7702 delegates strip their metadata hash. Nine of them publish their source was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.
TL;DR: J.P. The next evidence is transaction activity from approved institutions, additional supported use cases, integration with tokenised collateral and disclosures about outages and compliance controls.
The latest development in JPMβs corner of the digital-asset market is worth examining beyond the headline. A 2026-10-19 announcement describes a concrete change, but the investment consequences will depend on how it works in practice. The original record is available in the original company statement; here is what it establishes, why the distinction matters and what remains unproven.
J.P. Morgan said on October 19 that its JPM Coin deposit token, ticker JPMD, had been brought to Ethereum. The bank describes the service as available to eligible institutional clients, extending a token representing dollar deposits at J.P. Morgan to another public blockchain. It is not an open retail dollar coin anyone can mint or redeem freely. The important development is a major bank connecting its own deposit liabilities with blockchain-based institutional workflows rather than issuing an unrelated speculative crypto asset.
A deposit token and an independently issued payment stablecoin can look similar in a wallet interface, but the legal claims and eligible users may be very different. JPM Coin represents money deposited with the bank, subject to its programme terms and access controls. J.P. Morgan has also used the Base network, another Ethereum-compatible environment. The Ethereum expansion therefore increases where approved institutions can move the token without necessarily changing who is permitted to hold it.
The bank pointed to Ethereumβs liquidity and existing tokenised-asset activity as a reason for the integration. Large financial institutions are interested in placing cash next to securities on shared infrastructure so that trading, payments and collateral operations can be coordinated. Onchain cash legs may shorten operational handoffs, but legal settlement arrangements and counterparty exposure still matter. An Ethereum transfer being final at the protocol level is not a complete description of a regulated financial transaction.
For cryptocurrency investors, the central point is to distinguish an announced milestone from an immediate change in asset value. The underlying development can strengthen a companyβs product, legal position or operating capacity without determining what a token will trade for tomorrow. The linked source establishes what was disclosed; the valuation question requires a separate assessment of customers, costs, execution and market conditions. That gap between a confirmed fact and a forecast is where much of the investment risk sits.
Running a bank-backed instrument on public networks introduces a deliberate mix of openness and permissioning. Validators and infrastructure may be widely distributed, yet the asset itself can restrict eligible holders and transfer paths. That hybrid design is often more realistic for regulated institutions than assuming all treasury assets must be freely transferable. It also complicates claims that public-chain adoption automatically means universal decentralised access for users.
The next evidence is transaction activity from approved institutions, additional supported use cases, integration with tokenised collateral and disclosures about outages and compliance controls. The announcement confirms an Ethereum deployment but does not prove mainstream adoption by every banking customer. It shows how finance is experimenting with common blockchain infrastructure while preserving many of the boundaries and responsibilities of the conventional banking system.
Market watchers should also avoid treating a companyβs or regulatorβs headline as a substitute for terms and conditions. Tokens, shares and regulated service agreements create different rights, even when they coexist in one wallet or platform. A reliable follow-up should ask which entity is responsible, what a holder can actually redeem or transfer, and whether the claimed advantages appear in live activity. Those questions are more informative than an unsupported price target or an assumption that adoption is inevitable.
Primary source: original company statement (2026-10-19).
Written by the News Desk and edited by Samuel Rae.
An Ethereum investment product can advertise staking exposure without putting every unit of its ETH to work. Lidoβs October 23 comparison of European exchange-traded products brings attention to the cash-management choices behind the reward figures investors see.
TL;DRIn its new institutional note, Lido says products holding an unstaked liquidity buffer may earn rewards on less than their full ETH exposure. It promotes liquid staking as an alternative and uses WisdomTreeβs stETH-backed product as an example. Lido has a commercial interest in that comparison.
The arithmetic is straightforward even without ranking any funds. In an illustrative product with 100 ETH, a 20 ETH unstaked buffer would leave 80 ETH generating staking rewards. If the staked portion earned 3% over a year, it would produce 2.4 ETH before fees and other adjustments. Those are hypothetical inputs, not a forecast or a quoted product return.
A buffer is not necessarily wasted capital. It can provide liquidity when redemptions arrive or when other processes take time. The useful question is what operational benefit the buffer buys and how much reward the product gives up in exchange.
Ethereumβs withdrawal documentation explains that exiting validators pass through network processes and that demand can affect the timeline. A fundβs need to meet a commercial deadline does not accelerate the underlying protocol queue.
A transferable claim on staked ETH can be sold without waiting for every underlying validator to exit. But a sale needs buyers at an acceptable price. Transferability does not guarantee that a large transaction will execute at the value used in a fundβs accounting.
During ordinary trading, market makers may bridge that gap efficiently. Under stress, the amount of available liquidity and the cost of absorbing an order become more important. A structure that supports full staking can still face a difficult execution decision when many holders seek liquidity together.
The broader point echoes Bitcoin products using options for downside management: the underlying assetβs name cannot fully describe the investorβs payout.
Likewise, the process examined in CoinSharesβ fund liquidation shows why redemption rules deserve attention before a deadline arrives. Trading a share and withdrawing its underlying exposure are distinct operations.
NewsBTCβs coverage of corporate Ethereum staking adds another comparison: an equity holder owns a company with financing and management decisions, rather than a simple balance of staked coins.
Lidoβs note is therefore most useful as a prompt to examine the complete structure. Allocation, net reward sharing, liquidity arrangements and market depth must be read together before two headline staking rates can be meaningfully compared.
Written by the News Desk and edited by Samuel Rae.

Lido has opened a permissionless route to Ethereum validators that can hold much larger effective balances, but the first allocation is deliberately limited. Its October 23 launch of 0x02 Community Staking Module separates gaining access from receiving the full amount of stake a validator could eventually support.
TL;DRThe launch announcement sets the bond at 32 ETH for the first key and 30 ETH for each additional key. Lido supplies the allocated stake. New keys first receive a 32 ETH seed deposit; further deposits follow after activation through a separate top-up queue.
The module starts with a 0.01% share limit of Lido Coreβs total value locked and 32 top-up seats. Further capacity increases depend on a staged governance process and sufficient protocol inflows. A maximum balance is therefore a technical ceiling, not an immediate allocation promise to every operator.
The Ethereum change underneath this is EIP-7251, which allows a validatorβs effective balance to rise to 2,048 ETH while retaining a lower activation requirement. More stake can consequently be represented by fewer validator keys.
For an operator, fewer keys can simplify parts of administration. It also makes the amount controlled by each operational setup more consequential. Key count alone becomes a weaker way to judge how broadly stake is distributed.
That distinction fits the concentration questions examined in NewsBTCβs network-resilience coverage. Independent operators, infrastructure diversity and correlated failures all matter alongside the number of validators.
An operatorβs experience depends on how long a key waits for activation, how quickly additional stake arrives and how reliably the validator performs. A favorable projection at full allocation cannot describe the whole period between posting a bond and reaching that allocation.
The comparison with solo staking also requires care. A bonded operator receiving protocol stake and a solo staker providing all the capital are taking different roles. The same percentage headline can conceal different denominators, duties and sources of reward.
Large corporate ETH treasuries illustrate how staking decisions can involve substantial balances. The new CSM route instead concerns how independent operators can service stake allocated through Lido.
It is separate, too, from Ethereumβs execution-capacity tests. Supporting larger validators does not by itself raise the volume of application transactions a block can carry.
The staged launch gives the market concrete milestones to observe: activated keys, completed top-ups and approved capacity increases. Those measurements will show whether the permissionless route is expanding in practice, beyond the largest balance allowed by its design.
Written by the News Desk and edited by Samuel Rae.

TL;DR: Ethereum developers have removed the planned October 26 Glamsterdam activation on Hoodi while they investigate EIP-8037 interactions with existing contracts; no replacement date has been announced.
Ethereum developers have pulled the October 26 activation of Glamsterdam on the Hoodi testnet, introducing a pause that matters directly to operators preparing for the next network upgrade.
The Ethereum Foundation said Thursday that developers want additional time to investigate how EIP-8037 interacts with existing mainnet smart contracts. The old Hoodi target, October 26 at 17:42:48 UTC, epoch 132,352, is no longer valid. A replacement activation time has not been chosen.
This is a testnet scheduling decision, not a rollback of transactions already confirmed on Hoodi, and it should not be presented as an announced delay to a specific Ethereum mainnet launch date.
The decision removes the planned Amsterdam execution-layer activation and the Gloas consensus-layer activation from Hoodi's schedule. It also drops the accompanying plan to raise the testnet gas limit to 200 million at that epoch.
Those details matter because network upgrades involve multiple pieces of client software agreeing on exactly when a change takes effect. If a validator or node follows the original schedule after everyone else has removed it, the result can be a chain incompatibility rather than a harmless configuration mismatch.
The Foundation has therefore told operators to check revised instructions for both execution and consensus clients. Earlier compatibility tables cannot be assumed to reflect the postponement. A client version that was correct for the previous schedule might now need a new configuration or update.
Major blockchain upgrades are supposed to encounter their difficult questions in testing, before real economic activity depends on the new rules. EIP-8037's compatibility issue is the reason given for the pause, but the Foundation has not published a definitive diagnosis establishing a particular live exploit or failure.
The next useful signal will be a documented resolution, updated client releases and a fresh Hoodi activation epoch. Developers can then measure whether applications, block builders and validators behave as intended under the revised rules.
For ETH investors, the immediate effect is mainly on the upgrade calendar and development expectations. Ethereum's existing mainnet continues to operate under its current rules. For infrastructure teams, however, the message is operational and urgent: do not leave an obsolete October 26 activation hard-coded in production-like test systems.
A cautious testnet postponement is less exciting than a launch, but it is precisely how an upgrade process should handle an unresolved compatibility concern.
Source: blog.ethereum.org original announcement or data.
Related Reading: Ethereum; smart contracts; staking.
Written by the News Desk and edited by Samuel Rae.
