Ethereum Sets Oct. 6 Sepolia Test for Glamsterdam Amid Builder Risks
Ethereum developers have confirmed Oct. 6, 2026 as the next major public testing milestone for the upcoming Glamsterdam upgrade, with Sepolia scheduled to undergo the fork on that date. The upgrade is designed to increase Ethereum's capacity while changing how blocks are constructed and verified.
The testing phase has also exposed a potential weakness specific to public testnets. Developers warned that free test ETH could allow malicious actors to create disposable block-builder identities, submit unusually high bids and then withhold the transaction payloads associated with their winning blocks.
The issue does not put Ethereum mainnet funds at risk because it concerns a test environment where the ETH used has no meaningful monetary value. However, repeated attacks could interfere with Sepolia testing and make it harder for client teams and infrastructure providers to evaluate Glamsterdam before a potential mainnet deployment.
Glamsterdam Moves Toward Its First Major Public Test
Ethereum's official roadmap lists the Sepolia fork for Oct. 6, while the mainnet activation remains targeted for Q4 2026 without a confirmed date. The upgrade combines changes to Ethereum's execution and consensus layers and is intended to improve the network's ability to process more activity.
One of the major goals is to increase the amount of work Ethereum can safely process in each block. Recent testing has pushed the block gas limit toward 200 million, although that figure remains a testing configuration rather than a confirmed mainnet setting. A recent rehearsal also showed Ethereum continuing to confirm blocks under Glamsterdam's new block-building rules.
Ethereum developers have been conducting multiple devnet and testnet exercises before moving the upgrade to public networks. The Ethereum Foundation has also warned developers that Glamsterdam introduces changes that may affect applications, wallets, indexers and other infrastructure.
Free Test ETH Creates a Builder Attack Vector
Glamsterdam changes how specialized block builders interact with validators. Builders assemble transaction payloads and compete to have their blocks selected, while validators ultimately decide which block to accept.
On a public testnet, however, the cost of participating in this auction can be very different from mainnet. Because Sepolia's test ETH does not carry meaningful market value, an attacker could potentially create many builder identities and repeatedly submit bids that legitimate participants would not want to match.
During the recent core developer discussions, Ethereum consensus developer Potuz described the potential scenario of an attacker creating a large number of builders, rotating identities and offering very high bids without actually delivering the promised payload. The concern is that a malicious builder could repeatedly win an auction and then withhold the transaction data.
The problem is therefore less about stealing assets and more about disrupting the testing environment. If winning builders repeatedly fail to reveal payloads, validators and clients need mechanisms to recover and prevent the same actor from continuing the cycle under another identity.
Why Payload Withholding Matters
In Ethereum's block-building process, winning a builder is expected to provide the underlying execution payload associated with its bid. Validators need that information to construct and confirm the complete block.
If a builder wins an auction but fails to provide the payload, the network infrastructure needs to fall back to another method of producing a valid block. Developers said existing safeguards can trigger local block construction after multiple missing payloads, but repeated attacks using new builder identities could make that process more difficult.
The concern is particularly relevant on Sepolia because the network is being used to test the exact infrastructure that Glamsterdam will eventually rely on. An attacker who can repeatedly interfere with block construction could create noise that makes it harder to distinguish genuine client or protocol problems from deliberate disruption.
Developers therefore discussed the need for clients to identify problematic builders and prevent them from repeatedly winning through disposable identities.
Client Teams Face a Short Testing Window
Client teams are working against a compressed schedule ahead of the Sepolia fork. The source material says teams have until Sept. 29 to release Sepolia-ready software, leaving approximately one week before the Oct. 6 activation.
That is shorter than the typical 14-day period allocated for security reviews and bug-bounty testing during an Ethereum upgrade process. Developers accepted the tighter window partly because Sepolia is relatively centralized and can be recovered more easily if testing encounters a serious problem.
Ethereum's official bug bounty program already includes Glamsterdam-related protocol, client and compiler issues within its scope. The Ethereum Foundation says researchers can earn rewards for identifying qualifying vulnerabilities affecting the upgrade.
Ethereum Glamsterdam Bug Bounty Program
Glamsterdam Is Designed to Increase Ethereum Capacity
The builder changes are only one part of Glamsterdam. The broader upgrade is intended to improve Ethereum's ability to process more activity without making the network disproportionately difficult to operate.
A key component being tested is the use of block-level access lists, which provide information about the accounts and state data a block will access. This information can help clients prepare and process unrelated work more efficiently.
In a recent benchmark, Nethermind's execution client completed 2,302 performance tests, processing approximately 570.7 billion gas in three minutes and 15 seconds, according to reporting on the latest Glamsterdam rehearsal. That benchmark measured the execution client rather than the performance of the entire Ethereum network.
The testing also used a block gas limit approaching 200 million. Gas measures computational work on Ethereum, so a higher block limit can allow more activity to fit into each block. However, larger blocks also increase the workload for network participants, which is why the upgrade is being tested extensively before any mainnet decision.
Mainnet Date Remains Unconfirmed
The next public milestone is Sepolia on Oct. 6, followed by a planned Hoodi test that is tentatively scheduled for Oct. 27. Developers are expected to evaluate Sepolia's performance before deciding whether to keep the Hoodi date.
Ethereum's official roadmap currently places Glamsterdam's mainnet deployment in Q4 2026, but no specific mainnet activation date has been confirmed.
Production builder software from teams including Titan and Ultra Sound also still needs to complete its Glamsterdam transition, according to the supplied report. That leaves additional infrastructure work before developers can treat the upgrade as ready for Ethereum's main network.
Ethereum Glamsterdam Roadmap
Testing Will Determine the Next Step
The Sepolia test will provide developers with a larger public environment in which to evaluate Glamsterdam's new block-building mechanisms, higher-capacity configurations and client compatibility.
The builder-abuse issue illustrates why these public tests matter. A protocol change can behave correctly under normal conditions while still exposing operational problems when participants deliberately try to exploit its incentives. Testnets provide an environment where developers can identify those problems without putting mainnet assets at risk.
For now, Ethereum's timeline remains centered on the Oct. 6 Sepolia fork, followed by further testing and review. The mainnet date remains open, with the Ethereum Foundation's roadmap pointing to Q4 2026 rather than a fixed activation day.
