Ethereum developers confirmed the October 6 Glamsterdam activation on Sepolia at Thursday's All Core Developers Consensus call, and immediately raised an unusual risk with it: a Glamsterdam builder attack could make the public testnet phase miserable. Under EIP-7732's Enshrined Proposer-Builder Separation design, the same mechanism that cleans up Ethereum's block construction gives cheap test ETH a new use, flooding block auctions with disposable builders that win bids and never deliver the goods.
How a Glamsterdam builder attack works
Enshrined proposer-builder separation splits payload assembly from validator duties. Builders submit signed bids for the right to supply an execution payload, a proposer commits to the winning bid, and the builder then releases the transactions behind it. On mainnet the economics discipline the process, because producing an empty block costs real money. On a public testnet, test ETH carries no market value. Consensus developer Potuz warned that an attacker could create many builder identities, bid far above legitimate competitors, then refuse to provide the promised payload after winning. "I can just spin up a thousand builders," he told the call, later adding, "Any teenager can do this."
He framed the concern as an availability problem, not a theft vector, since no one's mainnet ETH is at risk. But the defense gap is real. Some client circuit breakers fall back to locally built blocks only after several payloads are missed, and Potuz said he was not aware of universal protections that could reject individual abusive builders. Even if a client reacts to missing payloads, a rotating fleet of disposable identities can keep bidding unless defensive logic identifies the pattern quickly. Sepolia's permissioned validator set, controlled by client and testing teams, gives developers operational control to recover the network if the first long-lived public run goes sideways.
A compressed client schedule
The Oct. 6 date, which developers had tentatively targeted earlier in September, now leaves clients racing. Developer Fredrik Svantes told participants the standard process calls for at least 14 days between release-ready client software and the first public testnet activation, time normally spent on internal security reviews, bug-bounty exposure and external audits. With developers discussing Sept. 29 as the latest sensible release date, only seven days separate the two milestones. Core developer Alex Stokes urged teams to ship earlier where possible so more reviewers can examine the code before the fork. Once release-ready clients exist, they can enter Ethereum's bug-bounty process immediately, which is thin comfort for a network upgrade that has already logged a bumpy testing season: Devnet-8 suffered non-finality during its Gloas activation, and a Platoberget scenario knocked 12 of 13 Besu nodes offline.
The Devnet-11 rehearsal that cleared the path went better. The test network, created as a controlled happy-path environment rather than an adversarial one, ran 84,000 validators in a multi-client configuration, completed its Gloas transition on Sept. 16 and pushed the block gas limit from 60 million to 200 million without losing finality. Organizers explicitly excluded deliberate attacks from its scope, saving adversarial experiments for the longer-running environment. That division of labor is exactly why the builder-abuse question is landing now: the devnets proved the upgrade works when everyone cooperates, and Sepolia is the first time outsiders get to misbehave under ePBS conditions.
What it means for mainnet
Two calendar notes matter for anyone tracking the upgrade. First, the 200 million gas figure is a test parameter, not a mainnet commitment, even though Glamsterdam is genuinely designed to expand Layer 1 capacity and stretch the execution-payload propagation window from roughly two seconds toward nine. The payload propagation work Ethereum has been testing separately is part of the same capacity story. Second, Hoodi, with its open validator set, follows Sepolia, and its timing depends on how cleanly the first fork goes. A rough Sepolia activation pushes every later date, including a mainnet slot that the roadmap still pegs to the fourth quarter of 2026 without naming a date.
The watch items are concrete. Do client teams release before Sept. 29, and do any ship builder-level circuit breakers tuned to disposable identities? Does Sepolia hold finality through its first weekend with strangers bidding? Ethereum has survived worse testnet chaos, and recovered, but every incident between now and Oct. 6 compounds a schedule that is already short on review days. The upgrade's hardest test may come from teenagers with free test ETH.
