Can Ethereum’s Glamsterdam upgrade test survive an attack anyone could launch?

1 day ago 41

Ethereum developers have confirmed a firm date for the first public test of the Glamsterdam upgrade, but the announcement comes with an unusual warning attached: the same testing process meant to prove the upgrade works could be sabotaged by an attacker with nothing more than free test tokens and a laptop. The Ethereum Glamsterdam upgrade is set to go live on the Sepolia test network on October 6, 2026, and developers say the way it changes block auctions creates an opening for so-called “fake” builders to disrupt the trial run.

Key takeaways

Ethereum’s public test of the Glamsterdam upgrade on Sepolia is scheduled for October 6, 2026, with client teams facing a software deadline of September 29.
Developers warn that attackers could exploit free Sepolia test ether and disposable builder identities to win block auctions and then withhold transaction payloads.
The attack cannot touch mainnet funds, but it could stall the infrastructure testing Ethereum needs before Glamsterdam reaches its main network.
A prior private rehearsal already raised the test network’s block gas limit toward 200 million without losing finality.
A second public test on Hoodi is tentatively planned for October 27, while a mainnet activation date remains unscheduled.

Ethereum schedules public test for Glamsterdam upgrade on Sepolia

The timeline is now locked in, at least for the next phase: Sepolia will host the first public trial of Glamsterdam on October 6, giving outside teams a chance to run their own software against the upgraded protocol before it ever touches real funds.

Confirmed October 6 test date and compressed software release timeline

That date leaves client teams with a noticeably tighter runway than usual. Developers now have until September 29 to ship Sepolia-ready software, which works out to roughly seven days before the fork goes live. That’s half the 14-day window Ethereum‘s standard upgrade process normally sets aside for security reviews and bug-bounty testing. Developers accepted the shorter window in part because Sepolia is relatively centralized and easier to recover if something goes wrong, according to reporting on the upgrade process. Adding to the pressure, production builder software from teams Titan and Ultrasound has not yet completed its own Glamsterdam fork transition, leaving another gap to close before the upgrade could be considered ready for Ethereum’s main network.

Hoodi test planned for October 27; mainnet activation undecided

Assuming Sepolia holds up, the next stop is Hoodi, tentatively planned for October 27. Developers say they will decide whether to keep that date only after watching how Sepolia performs. No mainnet activation date has been set, meaning the Ethereum upgrade timeline still has at least two more testnet checkpoints to clear before any real deployment conversation begins.

Glamsterdam introduces changes to validator and block builder protocol

At its core, the Glamsterdam upgrade pulls a relationship that currently lives outside Ethereum’s rules — the handoff between validators and specialized block builders — directly into the protocol itself.

New relationships between validators and specialized builders

Under the current system, specialized builders assemble blocks of transactions and compete against each other to have their version included on-chain. Whichever builder submits the winning bid is expected to hand over the underlying transactions once a validator accepts it. Glamsterdam formalizes that exchange inside Ethereum’s own protocol.

Upgrade raises block gas limit on testnet to 200 million

The upgrade’s ambitions go well beyond plumbing. A private rehearsal completed just a day before the Sepolia announcement raised the test network’s block gas limit toward 200 million without losing finality. Gas measures the computing work each transaction requires, so a higher ceiling means more room for payments, token swaps, and other activity before users start bidding against each other for space. That, in theory, could soften the fee spikes that hit Ethereum during periods of heavy trading or a popular token launch. For now, though, the 200 million figure remains a testnet setting rather than a commitment for Ethereum’s main network.

Security risks from malicious block builders during testnet auctions

The same mechanism that makes Glamsterdam’s builder auctions work smoothly on a live network becomes a liability on a free test network, and developers are candid about why.

Attackers could exploit free test ether and disposable builder identities

Because Sepolia test ether carries no real cost, there’s nothing stopping someone from creating an unlimited number of throwaway builder identities and using them to flood the auction. A malicious operator could submit bids far above every legitimate builder, win the auction repeatedly, and then simply withhold the payload they promised to deliver. Ethereum consensus developer Potuz put it bluntly during a recent core developer call: “I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads. Any teenager can do this.”

Repeated high bids and payload withholding can disrupt tests, prompting calls for stronger safeguards

The immediate danger isn’t financial. This kind of Sepolia testnet attack cannot threaten mainnet funds, since it’s confined to a network built for testing rather than value transfer. But it could still leave blocks stripped of their transaction payloads and derail the very infrastructure testing that Glamsterdam needs before it can move toward Ethereum’s main network. Existing safeguards typically only fall back to locally built blocks after several payloads have already gone missing — a delayed response that leaves a window for repeated abuse. Potuz argued that clients need to go further and actively identify and reject specific malicious builders, so an attacker can’t simply spin up a new identity and start the cycle over again. That recommendation now sits at the center of how development teams are approaching the shortened window before Sepolia’s October 6 launch.

FAQ

When will the public test for the Ethereum Glamsterdam upgrade begin?

The public test on the Sepolia testnet is scheduled for October 6, 2026.

What is the nature of the attack risk during the Sepolia testnet?

Attackers could use free test ether and disposable builder identities to repeatedly win block auctions and withhold transaction payloads, disrupting infrastructure testing.