Crypto
Ethereum Locked In Glamsterdam's Test Dates, and Its Developers Published the Playbook for Breaking It First
Ethereum's core developers confirmed the Glamsterdam upgrade's test schedule this week: Sepolia forks on October 6, Hoodi tentatively on October 27, with mainnet activation still unscheduled. And alongside the dates came an unusually candid security discussion. Consensus developer Potuz told Thursday's core developer call that a teenager with free test ether and disposable builder identities could repeatedly win the new block auctions and withhold transaction payloads, adding that spinning up a thousand builders and bidding high while delivering zero payloads is, in his words, something any teenager can do.
Here is what makes that remarkable: Glamsterdam moves the relationship between validators and specialized block builders into Ethereum's protocol itself. Builders assemble blocks and compete to supply them; once a validator accepts the winning bid, the builder is expected to reveal the transactions. On a free test network, a malicious operator can bid absurdly high, win every auction, and deliver nothing, leaving blocks empty. The exploit puts zero mainnet funds in danger. It targets Sepolia, where test ether costs nothing. What it endangers is the testing itself.
The developers' answer was equally direct: clients need to identify and reject individual malicious builders, so an operator cannot return under a fresh identity and keep winning. Existing safeguards fall back to locally built blocks only after several payloads go missing. The team is now closing that gap before mainnet. This is security engineering done in daylight, with the adversary's playbook published by the defenders themselves.
The timeline is tight. Client teams have until September 29 to ship Sepolia ready software, leaving seven days before the fork, half the 14 days Ethereum's normal process reserves for security reviews and bug bounty testing. Developers accepted the shorter window because Sepolia is relatively centralized and easier to recover. The day before the discussion, a large private rehearsal completed the Glamsterdam transition and raised the block gas limit toward 200 million while finality held firm. That 200 million figure matters: it is the capacity leap Glamsterdam exists to deliver.
The angle: most networks discover their attack surfaces after launch. Ethereum just published its own, with a named developer, a quotable line, and a fix in progress, three weeks before the first public test. That is what a mature base layer looks like: it red teams itself in public. The 'any teenager' line will travel, but the real story is the process that produced it.
What it means for you: Glamsterdam is the upgrade that turns Ethereum's block production into an open marketplace, and the team is stress testing that marketplace the way it deserves, adversarially and in the open. By the time this reaches mainnet, it will have survived its harshest critics: its own builders. That is exactly the kind of rigorous, unglamorous work that keeps your transactions settling for the next decade.
Quick answers
What is this story about?
Ethereum's core developers confirmed the Glamsterdam upgrade's test schedule this week: Sepolia forks on October 6, Hoodi tentatively on October 27, with mainnet activation still unscheduled. And alongside the dates came an unusually candid security discussion. Consensus developer Potuz told Thursday's core developer call that a teenager with free test ether and disposable builder identities could repeatedly win the new block auctions and withhold transaction payloads, adding that spinning up a thousand builders and bidding high while delivering zero payloads is, in his words, something any teenager can do.
Why does this story matter?
What it means for you: Glamsterdam is the upgrade that turns Ethereum's block production into an open marketplace, and the team is stress testing that marketplace the way it deserves, adversarially and in the open. By the time this reaches mainnet, it will have survived its harshest critics: its own builders. That is exactly the kind of rigorous, unglamorous work that keeps your transactions settling for the next decade.
Sources
New to crypto? Read the crypto glossary, browse frequent questions, read our story, or explore the story archive.