Ethereum has announced the Glamsterdam upgrade test date for October 6, amid warnings of potential exploitation by malicious builders.
Ethereum developers have set October 6 for the public testing of the Glamsterdam upgrade, but they have expressed serious concerns regarding the potential for exploitation by malicious builders.
Concerns Over Malicious Exploitation in Public Testing
During the Glamsterdam public test, attackers could leverage free test ether and temporary builder identities to dominate block auctions on the Sepolia testnet, potentially withholding transaction data. While this exploitation would not affect funds on the mainnet, it poses significant risks to the essential infrastructure testing needed before the Glamsterdam upgrade takes place.
The Glamsterdam upgrade is poised to enhance Ethereum's capacity by increasing the block size limit to around 200 million gas, which would allow for a greater number of transactions to occur before incurring higher fees. This upgrade also introduces changes to how validators interact with specialized block builders, who will create transaction blocks and compete for acceptance. Upon winning a bid, builders are expected to disclose their transactions.
However, the testing environment is vulnerable to abuse. As Ethereum consensus developer Potuz pointed out, a malicious actor could easily create multiple builder identities and submit inflated bids without delivering the promised transaction data. He stated, "I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads. Any teenager can do this."
Currently, safeguards only revert to locally built blocks after several payloads are missing, highlighting the need for client teams to identify and reject problematic builders to prevent malicious actors from re-entering with new identities.
This warning comes after a successful private rehearsal for the Glamsterdam upgrade, which managed to increase the block gas limit to the target of 200 million without compromising the network's finality. Developer teams now have until September 29 to prepare software compatible with Sepolia, providing only a week for security reviews and bug-bounty testing, which is significantly less time than is usually allotted for such upgrades.
The decision for a shorter review period was made due to the relative centralization of Sepolia, which allows for easier recovery in the event of issues. Moreover, production builder software from teams Titan and Ultrasound has not yet completed the transition to the Glamsterdam fork, causing further delays in readiness for mainnet integration.
A subsequent public test on Hoodi is tentatively scheduled for October 27, with developers planning to evaluate the results from Sepolia before finalizing that date. The timeline for mainnet activation remains uncertain.
