Ethereum Sets Oct. 6 Glamsterdam Test as Builder Attack Risk Draws Scrutiny

• Ethereum is targeting October 6 for the Glamsterdam upgrade on the Sepolia testnet, while the mainnet date remains unconfirmed.
• Developers identified a testnet-specific risk in which disposable block builders could submit high bids and then withhold transaction payloads.
• Devnet-11 successfully tested Glamsterdam’s new block-building architecture and raised its gas limit from 60 million toward 200 million without losing finality.

Ethereum developers are preparing to activate the Glamsterdam upgrade on the Sepolia testnet on October 6, marking one of the final major testing stages before a potential Q4 2026 mainnet release. The upgrade is designed to increase Ethereum’s Layer 1 capacity through changes including enshrined proposer-builder separation and block-level access lists. However, developers have identified a testnet vulnerability that could allow low-cost, disposable block builders to repeatedly win block auctions and then withhold transaction payloads, potentially disrupting Sepolia testing without threatening Ethereum mainnet funds.

Sepolia Test Set for October 6

Ethereum’s official Glamsterdam roadmap now lists the Sepolia fork on October 6 as the project’s next milestone. The mainnet deployment remains targeted for Q4 2026, but Ethereum developers have not confirmed an activation date.Glamsterdam combines major changes to Ethereum’s execution and consensus layers. One of the most important is enshrined proposer-builder separation, or ePBS, which brings the relationship between validators and specialized block builders directly into Ethereum’s protocol.

Builders assemble transaction payloads and compete for the right to supply them. Validators can select the winning bid without having to build the entire block themselves. The architecture is intended to improve Ethereum’s ability to process larger amounts of data while reducing its reliance on external block-building infrastructure.

Ethereum’s official roadmap also identifies block-level access lists as a central Glamsterdam feature. These lists tell nodes which accounts and stored data a block will access before execution, allowing more operations to be processed in parallel.

Developers Identify Fake-Builder Risk

The new builder architecture introduces a particular problem on public testnets. During Ethereum’s latest All Core Developers Consensus call, developers discussed how an attacker could create large numbers of disposable builder identities, submit artificially high bids and repeatedly win block auctions.

After winning, the builder could simply refuse to deliver the promised transaction payload. The economics make such behavior considerably easier on Sepolia because test ETH has no meaningful market value. An attacker therefore does not face the same financial cost that would apply when attempting similar behavior with real ETH on mainnet. Ethereum consensus developer Potuz warned that an attacker could continuously rotate builder identities, making simple blacklisting less effective. The concern is primarily about disrupting the test environment, not stealing user assets or permanently freezing Ethereum itself. If malicious builders repeatedly fail to reveal payloads, Sepolia could produce empty or incomplete blocks and make it harder for developers to determine whether Glamsterdam performs correctly under realistic network conditions.

200 Million Gas Test Clears Major Rehearsal

The warning comes after Glamsterdam successfully completed another important technical rehearsal. On Devnet-11, the network continued finalizing blocks after adopting the new block-building rules. The test network subsequently increased its block gas limit from approximately 60 million to 200 million. The higher ceiling creates room for substantially more computation and transaction activity inside each block. Nethermind’s execution client also completed 2,302 performance tests, processing 570.7 billion gas in three minutes and 15 seconds during its benchmark.

That test measured the performance of Nethermind’s software rather than the transaction speed of the entire Ethereum network. The Ethereum Foundation previously described 200 million gas as a credible post-Glamsterdam target, supported by improvements including ePBS, block-level access lists and changes to state-pricing economics.

However, 200 million should not currently be described as Ethereum’s confirmed mainnet gas limit. Developers are still testing different configurations before deployment.

Shorter Review Window Adds Pressure

Timing creates another challenge. Client teams are expected to release Sepolia-compatible software by September 29, leaving roughly seven days before the October 6 activation. That is shorter than the approximately two-week review period normally preferred for security testing and bug-bounty scrutiny before major public testnet upgrades. Developers appear willing to accept the compressed schedule because Sepolia is a test environment and can be recovered more easily than Ethereum mainnet if serious problems appear. The next public test is tentatively expected on Hoodi around October 27, although developers can adjust that schedule depending on Sepolia’s performance.

Why Glamsterdam Matters for Ethereum

Glamsterdam is primarily a scaling and infrastructure upgrade rather than a simple increase in transaction capacity. The combination of ePBS, block-level access lists and state-cost changes is designed to let Ethereum safely process larger blocks without making verification prohibitively expensive for network operators.

Ethereum ultimately wants more Layer 1 capacity while preserving decentralization. Larger blocks can accommodate more payments, token swaps and smart-contract activity before users compete aggressively for limited block space. That could help reduce periods of severe fee congestion. But larger blocks also require more computing and networking resources, which is why developers are conducting multiple testnet stages before committing to mainnet parameters.

Conclusion

Ethereum’s October 6 Sepolia deployment gives Glamsterdam a concrete public-testing milestone, but the upgrade is not yet ready for mainnet. Recent Devnet-11 testing showed that the new architecture can continue finalizing blocks while operating with much higher gas limits. The next challenge is proving that the system remains reliable in a public environment where malicious or poorly behaving builders can actively interfere.

The disposable-builder issue therefore represents exactly the kind of weakness testnets are intended to expose. If Sepolia performs reliably, attention will shift toward the planned Hoodi test and eventually Glamsterdam’s Q4 2026 mainnet activation. Until those stages are completed, the October 6 deployment should be viewed as an important stress test rather than Ethereum’s final Glamsterdam launch.