Ethereum Sets Glamsterdam Test Date but Warns of Sepolia Attack Vulnerability
Upgrade aims to boost network capacity while developers flag exploit risks in test environment
1Glamsterdam test timeline
Ethereum developers confirmed public testing for the Glamsterdam upgrade will begin October 6, 2026 on the Sepolia testnet. This follows successful deployments of previous upgrades Pectra (May 2025) and Fusaka (December 2025) in mainnet. The compressed testing schedule gives teams just seven days for security validation before the fork, half the standard 14-day window, due to Sepolia's more centralized architecture that allows easier recovery if issues arise.
2Capacity boost mechanics
Glamsterdam's core improvement increases block gas limit to approximately 200 million, enabling more transactions per block without overloading network validators. The upgrade modifies gas calculation methods and formally integrates specialized block builders into Ethereum's protocol. Builders compete to assemble blocks, with validators accepting the highest bid before expecting corresponding transaction data - a system currently vulnerable to exploitation in test environments.
3Sepolia attack vector
Developers identified a critical vulnerability where attackers can create thousands of fake builder identities on Sepolia, artificially inflating bids without submitting transaction data afterward. Consensus developer Potuz noted this requires minimal resources since testnet ETH holds no real value. Existing safeguards only switch to locally-built blocks after multiple data delivery failures, requiring additional client-side protections against identity-switching attackers.
4Testnet security tradeoffs
The compressed testing schedule leaves only seven days for security reviews and bug bounty programs before Sepolia's Glamsterdam fork on September 29. Developers accepted this risk because Sepolia's centralized nature allows easier recovery than mainnet. However, critical infrastructure like Titan and Ultrasound's block-building software hasn't completed Glamsterdam integration yet, potentially delaying subsequent Hoodi testnet trials planned for October 27.
5Protocol-level changes
Glamsterdam represents Ethereum's continued evolution post-Merge, introducing protocol-level validator-builder interactions. Builders compete to assemble the most valuable blocks, with validators theoretically receiving complete transaction sets after accepting bids. The system aims to sustainably increase throughput while maintaining decentralization - though testnet vulnerabilities highlight implementation challenges before mainnet deployment.
6Previous upgrade context
Glamsterdam follows Fusaka's December 2025 mainnet launch that revitalized sharding capabilities, which itself succeeded May 2025's Pectra upgrade - the largest network improvement since The Merge. This upgrade cadence demonstrates Ethereum's methodical approach to scaling while maintaining security, with each hard fork introducing carefully tested infrastructure changes before progressing to more ambitious throughput improvements.
7Attack mitigation strategies
Beyond existing fallback mechanisms that default to locally-built blocks after failed deliveries, developers recommend clients implement builder blacklisting capabilities. This prevents attackers from simply creating new identities after detection. The test environment's low economic stakes enable cheap attacks that wouldn't be feasible on mainnet, making thorough testing crucial before implementing similar auction mechanisms with real-value ETH.
8Mainnet deployment outlook
While Glamsterdam's testnet schedule proceeds, developers haven't committed to a mainnet launch date pending Sepolia and Hoodi test results. The recent Plataberget testnet deployment provided preliminary validation, but discovered vulnerabilities may require protocol adjustments. Ethereum's deliberate upgrade philosophy prioritizes security over speed, suggesting potential timeline adjustments if testing reveals fundamental design flaws in the new builder ecosystem.