Ethereum's Glammsterdam Upgrade to Test on Sepolia Testnet October 6

Ethereum (ETH)’s upcoming Glammsterdam upgrade is set to be tested on the Sepolia testnet on October 6. Concerns have been raised that malicious actors could exploit free test ETH and reusable identities to create 'fake builders' who win block auctions but fail to disclose transaction data.

Ethereum’s official roadmap lists the Sepolia fork date as October 6, with mainnet implementation scheduled for Q4 2026—though no specific date has been set. Earlier reports covered Glammsterdam’s public testnet validation process, which involves validators and block builders operating directly within the Ethereum protocol.

Under this structure, builders aggregate transactions to form blocks, while validators select blocks based on auction conditions. Winning builders must disclose transaction data (payload) within a specified timeframe. This system connects to ePBS, which integrates block proposers and builders into the protocol.

The issue lies in Sepolia’s operational environment: test ETH has no economic value, and builder identities can be easily regenerated. Attackers could create thousands of fake identities, bid aggressively in auctions, then withhold payload disclosure—disrupting block production. This could lead to missing blocks or lost transaction data, making it hard to distinguish between upgrade errors and malicious interference.

Potuz, an Ethereum consensus layer developer, noted at a core developers meeting that attackers could rapidly create thousands of builders, bid high repeatedly, then refuse to provide payloads—a tactic any teenager could execute. The low cost of such attacks stems from using free resources and fake identities.

This vulnerability is limited to the Sepolia testnet, as test ETH has no real value and doesn’t directly impact mainnet funds or transactions. However, repeated anomalies on the testnet could delay developers’ ability to identify root causes. The current safeguard involves validators switching to a backup mode that manually creates blocks after multiple payload failures—but this may still halt testing flow.

Developers also face challenges in identifying and rejecting problematic builders, as attackers can reconnect with new identities to repeat attacks. The schedule is tight: client teams must release Glammsterdam-compatible Sepolia versions by September 29, with deployment and fork activation taking seven days—half the usual 14-day window for security reviews and bug bounties.

Developers cited Sepolia’s relative centralization as a reason for accelerating timelines, noting that issues can be resolved more easily. The follow-up testnet trial on Hoodi is tentatively set for October 27, with the schedule subject to change based on Sepolia results. Mainnet implementation dates remain unspecified.

The upcoming test aims not only to expand block processing capacity but also to verify whether the protocol-integrated builder auction system functions reliably in low-cost attack environments. Sepolia’s fork outcome and client team responses will influence future testing schedules.