Ethereum warns Glamsterdam testnet faces builder abuse

Ethereum developers have confirmed an Oct. 6 Glamsterdam activation on Sepolia while warning that cheap test ether could let malicious builders repeatedly win block auctions and withhold their transaction payloads during the public test phase. Summary Ethereum developers confirmed Glamsterdam will activate on Sepolia October 6 before a later Hoodi test. Developers warned free test ether could let disposable builders win bids and withhold execution payloads. Client teams were urged to release Sepolia-ready software by September 29, leaving seven review days. Devnet-11 completed its Gloas transition and raised gas limits from 60 million to 200 million. Ethereum has not scheduled Glamsterdam mainnet activation, with its roadmap still targeting fourth quarter 2026. Ethereum’s Sept. 17 All Core Developers Consensus transcript shows participants accepted the Oct. 6 date after reviewing recent Glamsterdam devnet results, though developers simultaneously raised concerns about how Enshrined Proposer-Builder Separation could behave on a public network where test ETH carries no meaningful economic cost. You might also like: Ethereum Classic miners reverse Core Geth v1.13.0 migration after warning Ethereum Glamsterdam test could face cheap builder attacks At the center of the warning is EIP-7732, Glamsterdam’s Enshrined Proposer-Builder Separation design. Ethereum.org describes ePBS as a protocol change that separates the job of assembling transaction payloads from the validator’s consensus duties, moving a relationship that currently relies heavily on external infrastructure into Ethereum’s consensus rules. Under the design, builders can submit bids for the right to supply an execution payload. Once a proposer commits to the winning bid, the builder is expected to release the transactions behind it. Ethereum’s consensus specification defines builders as separate staked actors that submit signed execution-payload bids before broadcasting the corresponding payload envelope. During Thursday’s developer call, consensus developer Potuz warned that the economics change on a testnet because attackers can obtain test ETH without paying its mainnet market value. A malicious operator could create many builder identities, submit bids far above legitimate competitors and then refuse to provide the promised payload after winning. “I can just spin up a thousand builders,” Potuz said, explaining that the attacker could rotate them, bid aggressively and withhold payloads. He later added, “Any teenager can do this.” The developer framed the concern as a public-testnet availability problem, not a new route to steal mainnet ETH. On mainnet, a participant can already pay to produce an empty block, but the economic cost of obtaining block space limits the behavior. Test ETH makes persistent disruption much cheaper. Clients may need builder-level circuit breakers Existing safeguards may not be sufficient for the Sepolia environment. Potuz told developers that some client circuit breakers fall back to locally built blocks only after several payloads are missed, while he was not aware of universal protections that could reject individual abusive builders.