Ethereum schedules Glamsterdam testnet fork for Oct. 6 as developers flag a cheap attack that could disrupt it
A single actor spinning up fake builders could win block auctions on Sepolia and withhold payloads, freezing the very traffic developers need to rehearse against.
Illustration · generated, not a photograph
Ethereum's Glamsterdam upgrade will hit its first public testnet on Oct. 6, but developers delivering the news on Thursday's core developer call paired the date with a warning: a trivially cheap attack on the Sepolia testnet could freeze blocks and derail the rehearsal itself.
The concern, raised by consensus developer Potuz on the call, is that Sepolia's test ether is free for the taking. That removes the economic barrier that protects Ethereum's mainnet from the same scheme. As Potuz put it, "I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads." He added that "any teenager can do this." The attack works because Glamsterdam changes how blocks are produced. The upgrade moves the relationship between validators and specialized block builders — the operators who assemble transaction sets and compete to supply them — into the protocol itself. A validator accepts the winning bid, and the builder is then supposed to reveal the underlying transactions. On a test network where bidding costs nothing, a malicious operator can outbid every legitimate builder, win block after block, and then deliver nothing.
Developers noted that existing fallbacks are slow to kick in. Clients typically switch to locally built blocks only after several payloads have failed to appear. Potuz also called for clients to identify and reject individual builders, so that a bad actor cannot simply re-register under a fresh identity and keep winning.
Why the test date matters
The Oct. 6 run is a dress rehearsal for Glamsterdam, Ethereum's next major upgrade. The fork is designed to fit more activity into each block without overburdening verification hardware, and alongside gas-pricing changes it is intended to support a block gas limit of roughly 200 million — expanding room for payments and trades before fee bidding becomes competitive. If fake builders win auctions and withhold payloads, developers lose the realistic traffic conditions the rehearsal is meant to provide.
Funds on Ethereum mainnet are not at risk. The attack scenario is confined to Sepolia, where test ether carries no meaningful value, though it could leave blocks without transaction payloads and stall the testing needed before Glamsterdam ships.
The warning arrived a day after a large private rehearsal completed the Glamsterdam transition and pushed its block gas limit toward 200 million without losing finality, according to CoinDesk. That success sits alongside a known gap: production builder software run by teams Titan and Ultrasound has yet to complete a Glamsterdam fork transition, meaning the upgrade is not yet considered mainnet-ready.
The timeline is also compressed. Client teams have until Sept. 29 to ship Sepolia-ready software — seven days before the fork, half the 14 days Ethereum's standard process reserves for security reviews and bug-bounty testing. Developers accepted the shorter window on the grounds that Sepolia is relatively centralized and easier to recover if something goes wrong.
A second public test on the Hoodi testnet is tentatively set for Oct. 27, though developers will revisit that date after observing Sepolia. Mainnet activation remains unscheduled.
Source reporting
The outlets whose reporting this account was written from.
Written from the reporting and primary documents credited at the foot of this story. Facts are credited to the outlet or document that established them. How Chainpress works