Ethereum developers have announced the dates for the Glamsterdam upgrade public test, set for October 6, but have raised concerns over potential exploitation by malicious builders.
Free test ether allows bad actors to outbid legitimate competitors and withhold transaction data, while client teams have significantly less time for review ahead of Sepolia.
During the public test, attackers could use free test ether and temporary builder identities to dominate block auctions on Sepolia, potentially withholding transaction payloads. Although this would not compromise mainnet funds, it could severely disrupt the necessary infrastructure testing before the Glamsterdam upgrade is implemented.
Glamsterdam represents Ethereum's next significant enhancement, aiming to increase the capacity of each block without overburdening verification systems. This upgrade, along with adjustments to gas pricing, aims to support a block gas limit of approximately 200 million, facilitating more transactions before users have to pay higher fees.
The upgrade also modifies the interaction between validators and specialized block builders within the Ethereum protocol. Builders will create transaction blocks and compete to have them accepted. Once a validator selects a winning bid, the builder is expected to disclose the transactions.
However, this system is susceptible to abuse in a free testing environment. A malicious user could create numerous builder identities, submit inflated bids, and repeatedly win auctions while failing to provide the promised transaction data. "I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads," said Ethereum consensus developer Potuz during a core developer call. "Any teenager can do this."
Developers noted that current safeguards only revert to locally built blocks after multiple payloads are missing. Potuz emphasized the necessity for clients to identify and reject problematic builders to prevent attackers from re-entering with new identities.
This warning follows a successful private rehearsal for the Glamsterdam transition, which increased the block gas limit to 200 million without compromising finality. Client teams now have until September 29 to prepare software compatible with Sepolia, a timeline that allows only a week for security reviews and bug-bounty testing, half of what is typically allotted during Ethereum upgrades.
The decision for a shorter review period was made due to Sepolia's relative centralization, which allows for easier recovery in case of issues. Additionally, production builder software from teams Titan and Ultrasound has yet to complete the Glamsterdam fork transition, creating further delays before the upgrade can be considered ready for mainnet integration.
The next public test on Hoodi is tentatively scheduled for October 27, with developers planning to assess the Sepolia outcomes before confirming that date, while mainnet activation remains unscheduled.