Ethereum has locked in an October 6 Sepolia activation for Glamsterdam, but developers are already worried public-testnet economics could make it a sitting duck for cheap builder abuse.
- Sepolia is set for Oct. 6; Hoodi is expected to follow
- ePBS raises a real builder-abuse risk on public testnets
- Client teams have a tight Sept. 29 release target
- Mainnet timing is still not confirmed
Ethereum developers confirmed during the Sept. 17 All Core Developers Consensus call that Glamsterdam will activate on Sepolia on October 6, with a later Hoodi test expected afterward. The upgrade is meant to push ahead on block-building and throughput changes, but the timeline comes with a warning. If test ETH is easy to obtain, malicious builders can cheaply turn a public testnet into a griefing arena.
The concern is centered on Enshrined Proposer-Builder Separation, or ePBS, tracked in EIP-7732. In plain English, that design splits block duties: a builder assembles the execution payload, the transaction data that actually gets executed, while the proposer handles consensus responsibilities. The goal is cleaner block construction and better protocol efficiency. The downside is that it creates a new abuse surface if a builder wins an auction and then simply withholds the payload.
That kind of behavior is especially annoying on a public testnet because the attacker does not need much skin in the game. Consensus developer Potuz put it bluntly on the call:
“I can just spin up a thousand builders, ”
“Any teenager can do this.”
That is the ugly part of open testing. A testnet is supposed to help developers, client teams, validators, wallets, and infrastructure operators catch bugs before anything touches mainnet. But if someone can repeatedly win builder auctions and withhold payloads for almost no cost, the network can end up spending its time surviving nonsense instead of proving readiness.
The technical mechanics matter here. Under ePBS, a withheld payload can force fallback behavior, delay block production, and create repeated disruption without requiring a serious economic commitment from the attacker. On mainnet, that kind of strategy gets expensive fast. On a testnet, where the tokens are not real money and faucets are part of the game, the cost can be close to trivial.
The schedule is tight too. According to Fredrik Svantes, Ethereum normally recommends at least 14 days between release-ready client software and the first public testnet activation. The latest target discussed for Sepolia-ready software is Sept. 29, which leaves only seven days before the planned Oct. 6 activation. That is not a disaster, but it is not generous either.
Consensus software is not the place for vibes-based shipping. A compressed review window means less time for client teams, auditors, and infrastructure operators to spot edge cases before the fork goes live. If a bug shows up after the window closes, the entire ecosystem gets a fun little reminder that “we’ll fix it later” is a terrible consensus strategy.
There is at least one counterweight to the caution: controlled rehearsal networks have been moving forward. Devnet-11 had genesis on Sept. 14 and completed its Gloas transition on Sept. 16. It also raised the gas limit from 60 million to 200 million while running with 84, 000 validators.
That is meaningful testing, but it is still a managed environment. Devnet-11 did not include adversarial attacks, so its clean run does not prove the public testnet will be equally smooth. It only shows that the mechanics can work when the room is not full of people trying to knock over the furniture.
That distinction matters because Ethereum has already seen messy behavior in testing. Developers noted non-finality during earlier devnet activity, and they also discussed a prior adversarial scenario that reportedly knocked 12 of 13 Besu nodes offline while slowing Erigon and Ethrex. In other words, this is not the first time the network has run into the limits of its own assumptions.
For readers who do not live inside Ethereum client logs, finality means the chain has reached a point where blocks are considered effectively settled and extremely unlikely to be reversed. Losing finality on a testnet is a big deal. It means the network is struggling to coordinate properly, which is exactly the kind of failure developers want to flush out before a mainnet fork.
There are broader reasons Glamsterdam matters too. The upgrade is tied not just to ePBS, but also to Block-Level Access Lists and gas repricing. Those changes affect how blocks are built, how execution is priced, and how much load the network can handle. The jump to 200 million gas on Devnet-11 is part of that testing work, but it is a rehearsal setting, not a mainnet promise. Test values are not commitments, no matter how eager the market gets to pretend otherwise.
That last point is worth underlining because crypto loves to turn every test parameter into a fantasy forecast. A bigger gas limit in a devnet means the upgrade is being stress-tested under heavier conditions. It does not mean Ethereum is about to flip mainnet into a 200 million gas free-for-all. Reality remains stubborn, which is inconvenient for the more unhinged price-forecast merchants.
Alex Stokes pushed the practical side of the rollout: get client software out earlier if possible so reviewers have more time and the bug-bounty process can start without delay. That is the sensible stance. The earlier the code is public, the more likely the ecosystem catches weird behavior before it becomes everyone else’s problem.
The rollout path itself is still not fully nailed down. Sepolia is the first public checkpoint, and Hoodi is expected to follow later. According to the network descriptions cited in the reporting, Sepolia uses a more controlled validator setup, which gives developers more room to respond if something goes wrong. Hoodi, by contrast, has an open validator set and is intended for staking and protocol testing, which makes it useful but also less forgiving if the upgrade stumbles.
What is missing is a confirmed mainnet date. Ethereum’s roadmap still points to the fourth quarter of 2026 for Glamsterdam mainnet, but there is no fixed activation epoch or timestamp yet. That leaves room for more testing, more fixes, and more opportunities for protocol developers to discover whether their latest clever idea survives contact with the real network.
That is the core tension here. Ethereum keeps pushing toward more sophisticated block-building rules and better execution mechanics, and that drive is part of what keeps the network relevant. But the more complex the machinery gets, the more opportunities there are for cheap griefing, rushed reviews, and sloppy assumptions to bite back. Public testnets are useful precisely because they are not sterile. They are also useful because they expose the ways people will abuse anything that looks even slightly gameable.
Key questions and takeaways
-
Why is Sepolia important for Glamsterdam?
Sepolia is the first public checkpoint for the upgrade, so it gives Ethereum a broader real-world rehearsal before anything reaches mainnet. If it misbehaves, developers get an early warning instead of a surprise later. -
What is the builder-abuse risk under ePBS?
A malicious builder can win a block-building auction and then withhold the execution payload, disrupting block production and forcing fallback behavior. Because test ETH is cheap to obtain, that kind of attack can be repeated with very little cost. -
Why does the Sept. 29 release target matter?
It leaves only seven days before the Oct. 6 Sepolia activation, which is shorter than the 14-day review window developers normally recommend. Less review time means more room for bugs to slip through. -
Does Devnet-11 prove Glamsterdam is ready?
No. Devnet-11 showed the upgrade can work in a controlled environment, including a jump from 60 million to 200 million gas and 84, 000 validators, but it did not include adversarial abuse. Public testing is a different beast. -
Is a mainnet launch date set yet?
No confirmed mainnet activation date has been set. Ethereum’s roadmap still points to the fourth quarter of 2026, but that is a target, not a locked schedule. -
Why does Glamsterdam matter beyond protocol plumbing?
Because changes like ePBS, Block-Level Access Lists, and gas repricing affect how Ethereum builds blocks, prices execution, and handles throughput. Those details shape the network’s long-term performance and competitiveness.
Ethereum is doing what serious infrastructure should do: testing hard, looking for weak spots, and refusing to pretend that complexity comes for free. The upside is progress. The downside is that public testing can get messy fast when the attack surface is cheap and the timeline is tight. That is not a reason to stop. It is a reason to stop kidding ourselves.
Further reading
A few related pieces if you want the finer points on Glamsterdam and the builder-abuse angle.
