Ethereum Glamsterdam Upgrade: October 6 Sepolia Test Launch Faces Builder Attack Concerns

Key Takeaways

Table of Contents

Sepolia testnet will deploy Ethereum’s Glamsterdam upgrade on October 6, 2026
Core developers identified a vulnerability where malicious actors could exploit free testnet tokens to create fraudulent builder identities
Bad actors could generate thousands of counterfeit builders, secure auction bids, and refuse to deliver transaction information
Development teams face a September 29 deadline to ship Sepolia-compatible versions, allowing just seven days for security audits
The production network deployment timeline remains undefined, though Ethereum aims for fourth quarter 2026

Ethereum’s core development team has officially designated October 6 for the inaugural public deployment of the Glamsterdam upgrade on the Sepolia testing environment. This scheduling update arrived together with cautionary notes regarding a vulnerability that could undermine the testing process.

ETHEREUM’S NEXT MAJOR UPGRADE IS MOVING FORWARD.
Glamsterdam is scheduled to hit the Sepolia testnet on October 6, followed by a tentative Hoodi test on October 27.
Developers have identified a potential weakness where attackers could create fake builder identities, submit huge… pic.twitter.com/79L6vjSf4I
— MANDO CT 🇮🇪 🇦🇪 🇬🇧 (@MandoCT) September 18, 2026

The identified risk revolves around Glamsterdam’s block construction mechanism. This upgrade implements a framework known as Enshrined Proposer-Builder Separation, abbreviated as ePBS. Within this architecture, dedicated block builders engage in competitive bidding to provide transaction bundles to network validators.

While participation in these auctions on Ethereum’s production network requires actual capital investment, Sepolia operates differently—test tokens carry no monetary value, fundamentally altering the threat landscape.

Anatomy of the Potential Exploit

At a September 17 developer conference call, consensus layer developer Potuz outlined the vulnerability. A malicious participant could establish numerous fraudulent builder accounts, place artificially elevated bids to secure block auctions, then deliberately withhold the required transaction information.

I am not sure you are prepared for Glamsterdam on Ethereum pic.twitter.com/O57rRe7XDr
— Ben {chmark} Adams ⟠ (@ben_a_adams) September 16, 2026

“I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads,” Potuz stated. “Any teenager can do this.”

While actual financial assets would remain secure, such an attack could paralyze testnet operations and prevent developers from accurately assessing the upgrade’s behavior under authentic scenarios.

Current protective measures may prove insufficient. Certain client implementations only activate defensive protocols after multiple payload failures. Developers emphasized the necessity for mechanisms to permanently exclude specific builders, preventing attackers from circumventing restrictions through identity rotation.

Glamsterdam’s Core Objectives

Glamsterdam represents Ethereum’s upcoming significant protocol enhancement. The upgrade aims to substantially boost the network’s per-block throughput capacity, establishing a gas ceiling near 200 million units—a notable increase from the 60 million observed in preliminary testing phases.

Additionally, the upgrade expands the timeframe for broadcasting transaction payload information from approximately two seconds to roughly nine seconds, providing nodes with extended processing time for larger block volumes.

A closed development network designated Devnet-11 successfully executed a Glamsterdam transition on September 16. This environment operated 84,000 validators across diverse client implementations and elevated the gas threshold toward 200 million while maintaining network finality.

Implementation Schedule and Future Milestones

Client development teams face a September 29 deadline for delivering Sepolia-compatible releases. This schedule provides merely seven days prior to the October 6 activation—half the standard 14-day period Ethereum typically allocates for security assessments and defect identification.

Developers approved this compressed timeline because Sepolia utilizes a managed validator configuration that facilitates recovery operations should complications emerge.

Following the Sepolia deployment, testing on the Hoodi testnet has been provisionally scheduled for October 27. This subsequent phase remains contingent upon Sepolia’s performance outcomes.

Ethereum has yet to establish a production network activation schedule. The project’s official development roadmap positions Glamsterdam within Q4 2026, though specific epoch numbers or timestamps await confirmation. Production-grade builder implementations from Titan and Ultrasound teams have not yet successfully completed Glamsterdam fork transitions.