Ethereum developers have locked in Oct. 6 for the Glamsterdam upgrade on the Sepolia testnet, while warning that the public test could face a new kind of disruption from malicious block builders. The date was confirmed on the Sept. 17 All Core Developers Consensus call after Devnet-11 completed its fork rehearsal without losing finality.
The concern centers on EIP-7732, the Enshrined Proposer-Builder Separation design at the heart of Glamsterdam. Under ePBS, builders submit bids for the right to supply an execution payload, and once a proposer commits to the winning bid, the builder is expected to release the transactions behind it. Ethereum’s consensus specification defines builders as separate staked actors that submit signed bids before broadcasting the corresponding payload envelope. Consensus developer Potuz told the call that the economics change badly on a testnet, where test ether carries no real cost.
A thousand builders and a teenager
Potuz laid out the attack plainly. An operator could create many builder identities, obtain test ETH for free, bid far above legitimate competitors and then refuse to hand over the promised payload after winning. Client circuit breakers that fall back to locally built blocks only after several missed payloads may not cope with attackers who simply return under fresh identities. Even if a client reacts to missing payloads, disposable builders could keep bidding unless defensive logic identifies and restricts the behavior quickly enough. Potuz said he was not aware of universal protections that could reject individual abusive builders.
“I can just spin up a thousand builders,” Potuz said. He later added, “Any teenager can do this.”
He framed the risk as an availability problem for the public testnet, not a route to steal mainnet funds. On mainnet, paying for block space keeps the behavior expensive; anyone can already pay to produce an empty block. On Sepolia, persistent disruption becomes nearly free. Developers did not present the attack as a confirmed exploit, but as something they expect public testing to expose once outsiders can participate under ePBS conditions. Application and infrastructure teams rely on testnets to check their software against functioning blocks, which is why the developers want stronger safeguards before the fork goes public.
Compressed review window
The Oct. 6 date also squeezes client teams. Developer Fredrik Svantes said Ethereum’s standard process calls for at least 14 days between release-ready client software and a public testnet activation, time normally used for internal security reviews, bug-bounty exposure and possible external security work. The Sept. 29 latest release date discussed on the call leaves seven days, half the usual window.
Participants accepted the compressed schedule partly because Sepolia runs a permissioned validator set controlled by client and testing teams, making recovery easier if software breaks. Hoodi, by contrast, has an open validator set intended for staking and protocol testing. Core developer Alex Stokes urged teams to ship earlier where possible, since release-ready clients can enter Ethereum’s bug-bounty process immediately once they are available.
The compressed schedule follows a string of earlier testing problems. A Sept. 3 developer agenda recorded non-finality during the Devnet-8 Gloas transition affecting multiple consensus clients, and Devnet-9 saw unplanned non-finality that pushed teams into further iterations before Devnet-11. A separate Plataberget scenario knocked 12 of 13 Besu nodes offline and slowed Erigon and Ethrex nodes. Each failure added fixes and edge cases to the testing queue, and each fix narrowed the slack in the timetable.
What Devnet-11 proved
Devnet-11 was built as a controlled rehearsal, not an attack network. Genesis was set for Sept. 14, the Gloas transition for Sept. 16, and the block gas limit moved from 60 million to 200 million shortly afterward. Nethermind completed all 2,302 performance tests, and the network ran 84,000 validators across a multi-client configuration without losing finality. Adversarial testing stays on the longer-running Plataberget environment, which exists precisely for hostile scenarios and has already produced the most painful findings of the Glamsterdam test cycle.
The 200 million gas limit is a test parameter, not a mainnet commitment. Glamsterdam also includes Block-Level Access Lists and several gas-pricing changes. The ePBS design extends the execution-payload propagation window from roughly two seconds to around nine seconds, giving nodes more time to distribute and validate larger payloads. Earlier compatibility reviews found that wallets, indexers and gas estimators using fixed assumptions may need changes, and that contracts relying on fixed gas stipends or gas-sensitive execution patterns require testing before the fork reaches mainnet.
Mainnet still undated
Ethereum’s public roadmap continues to list Glamsterdam for the fourth quarter of 2026, but the mainnet date remains unconfirmed. Hoodi is expected to follow Sepolia, with its timing tied to how the first public fork goes, meaning problems on Sepolia could move subsequent dates. The draft mainnet incident-response plan still contains no activation epoch or timestamp; the document leaves those fields blank while listing the client and coordination roles to be filled before mainnet deployment.
Before Sepolia, developers had tentatively picked Oct. 6 only as a tentative target, dependent on another stable private-devnet transition. The Sept. 17 call moved the timetable forward after Devnet-11 delivered that transition. The decision now puts the first public Glamsterdam deployment about three weeks out, with client releases due within eleven days of the call.
The fork is the decisive test for ePBS in the wild. If Sepolia runs smoothly, Glamsterdam moves to Hoodi and the mainnet conversation gets serious. If builders behave the way Potuz expects, client teams will need builder-level circuit breakers and identity-based defenses before the upgrade gets anywhere near production. Either outcome will shape the fourth-quarter timeline that Ethereum has publicly committed to but not yet scheduled.