TL;DR
- Ethereum developers scheduled Glamsterdam’s Sepolia test for Oct. 6, warning fake builders could exploit free test ether to win auctions and withhold payloads.
- Client teams have seven days between the Sept. 29 software deadline and fork, half the review period normally reserved for security and bug testing.
- Glamsterdam targets a block gas limit near 200 million, while Hoodi testing is tentatively scheduled for Oct. 27 and mainnet activation remains unscheduled.
Ethereum developers have set Oct. 6 for the public Sepolia test of Glamsterdam, the network’s next major upgrade, but the timetable comes with an unusual security concern. Developers warned that attackers could exploit free test ether and disposable builder identities to repeatedly win block auctions, then withhold transaction payloads. The risk is not to mainnet funds, but to the reliability of the rehearsal itself, where fake builders could stall traffic and undermine testing. Glamsterdam is intended to increase Ethereum’s block capacity while keeping verification demands manageable for the computers securing the network.
Fake Builders Could Complicate Ethereum’s Glamsterdam Rehearsal
The vulnerability stems from Glamsterdam’s approach to block construction. Specialized builders assemble blocks and bid to supply them, while validators accept the winning offer before the builder reveals the transactions. On Sepolia, where test ether carries no meaningful cost, a malicious participant could submit exaggerated bids through many identities, win repeatedly and refuse to deliver payloads. That creates a surprisingly cheap disruption strategy, allowing an attacker to interfere with testing without putting meaningful capital at risk. Existing safeguards fall back to locally built blocks only after several missing payloads, leaving room for repeated interference.
Developers are also operating under a compressed release schedule. Client teams have until Sept. 29 to publish software ready for Sepolia, leaving just seven days before the Oct. 6 fork instead of the 14 days normally reserved for security reviews and bug-bounty testing. The shortened window adds pressure because the public test must evaluate both Glamsterdam’s capacity gains and defenses against malicious builders. Developers accepted the tighter schedule because Sepolia is relatively centralized and easier to recover if something breaks, although production builder software from Titan and Ultrasound has not yet completed a Glamsterdam fork transition.
Glamsterdam is designed to support a block gas limit of about 200 million, allowing more activity to fit into each block before users begin competing through higher fees. A private rehearsal completed the transition and raised the block gas limit toward that level without losing finality. The next challenge is proving the upgrade can withstand adversarial behavior outside a controlled environment. Hoodi testing is tentatively scheduled for Oct. 27, but developers will decide whether to keep that date after reviewing Sepolia. Mainnet activation remains unscheduled, leaving the public tests to determine when Glamsterdam is ready for Ethereum itself.