Ethereum warns test‑net builders could disrupt Glamsterdam upgrade trials

Ethereum developers cautioned that the upcoming public test of the Glamsterdam upgrade on the Sepolia testnet could be disrupted by malicious builders exploiting free test ether and disposable identities. Such actors could repeatedly win block‑builder auctions and refuse to deliver transaction payloads, delaying critical infrastructure testing.

How the attack could work

Glamsterdam moves block‑building into the protocol, where specialized builders submit bids to supply transaction blocks to validators. On a free test network, an attacker can create many builder identities, submit very high bids, win the auctions, and then withhold the underlying transaction payloads. The developers noted that existing safeguards only fall back to locally built blocks after several missing payloads, giving attackers a window to cause disruption.

Timeline and testing windows

• Sepolia public test is scheduled for Oct. 6, with client teams required to release Sepolia‑ready software by Sep. 29, leaving a seven‑day review window.
• The next testnet, Hoodi, is tentatively set for Oct. 27, pending observations from Sepolia.
• Mainnet activation of Glamsterdam remains unscheduled.

Developer response

Consensus developer Potuz emphasized the need for clients to identify and reject individual builders, preventing attackers from reappearing under new identities. The warning follows a successful private rehearsal of the Glamsterdam transition, which raised the block gas limit toward 200 million without losing finality.

Implications

While the attack would not affect real ETH funds—test ether on Sepolia has no monetary value—it could stall the testing process required before the upgrade reaches mainnet. The shortened review period reflects the relative centralization of Sepolia and the expectation that any issues can be recovered more easily than on mainnet.