preferred on
Points of Focus
- Cheap test ETH could let malicious builders disrupt Glamsterdam testing on Sepolia.
- Attackers could win ePBS bids with disposable builders, then withhold execution payloads.
- Glamsterdam is set for Sepolia on Oct. 6, with client releases due Sept. 29.
Ethereum developers have warned that Glamsterdam’s Oct. 6 Sepolia test could be disrupted by malicious builders using free test Ether (ETH) to submit high bids, win block auctions, and then withhold the execution payloads they promised to deliver.
The scenario wouldn’t put mainnet funds at risk, but repeated missing payloads could interfere with the public testing Ethereum needs before Glamsterdam advances toward mainnet.
Free test ETH weakens Glamsterdam builder economics
The issue centers on Ethereum Improvement Proposal (EIP) 7732, or Enshrined Proposer-Builder Separation. Glamsterdam brings builders into Ethereum’s protocol as staked actors that compete to supply execution payloads.
Once a proposer accepts a builder’s bid, the builder can still owe the promised payment even if the payload isn’t revealed. On mainnet, losing real ETH makes repeated abuse expensive. Sepolia changes that calculation because test ETH carries no meaningful market value and is available through faucets.
Ethereum consensus developer Potuz warned during the Sept. 17 core developer call that an attacker could rotate through large numbers of builder identities, outbid legitimate participants, and repeatedly fail to deliver payloads.
Developers discussed the need to identify and reject malicious builders so an attacker can’t keep returning under fresh identities. Sepolia’s permissioned validator set, controlled by client and testing teams, also gives developers more control over recovery if testing stalls.
Glamsterdam Sepolia test gets seven-day review window
Client teams have until Sept. 29 to release Sepolia-ready software, leaving seven days before the Oct. 6 fork. Ethereum’s upgrade process normally calls for at least 14 days between release-ready clients and the first testnet activation, giving teams time for security reviews, bug-bounty coverage, and possible external review.
The tighter schedule follows earlier Glamsterdam testing problems. A Sept. 7 testing agenda recorded a Platåberget test that knocked 12 of 13 Besu nodes offline and slowed Erigon and Ethrex. Devnet-9 also encountered unplanned non-finality during testing.
Those incidents occurred on test infrastructure, not Ethereum mainnet, but they raise the importance of Sepolia as the next public checkpoint for Glamsterdam’s client stack.
Ethereum’s roadmap still lists Glamsterdam for mainnet in Q4 2026 without a confirmed activation date. The Sept. 17 developer agenda lists Hoodi for Oct. 27 as the tentative next testnet after Sepolia.
Share
Most read articles
