Ethereum developers have locked Oct. 6 as the test date for Glamsterdam, the next major upgrade to the protocol. But they're flagging a critical vulnerability: bad actors with free test ether and multiple fake identities can repeatedly win block auctions on Sepolia, then ghost the network by withholding payloads entirely.
The exploit exploits how Glamsterdam restructures the validator-builder relationship directly into Ethereum's protocol. Builders assemble transaction blocks and bid competitively to supply them. Once a validator accepts a winning bid, the builder must reveal the underlying transactions. On a free test network, a malicious operator can submit bids far higher than legitimate builders, win auctions in succession, and simply refuse to provide the promised payload.
Ethereum consensus developer Potuz laid out the math during a core developer call: "I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads. Any teenager can do this."
The result: Sepolia blocks go empty. Traffic stalls. Developers can't test how the upgrade handles real-world conditions. While mainnet funds remain safe, the test becomes useless.
Glamsterdam itself targets a block gas limit around 200 million—roughly doubling current capacity—alongside gas pricing adjustments to cram more payments and trades per block before fees spike. A successful private rehearsal one day prior hit that 200 million gas target without losing finality, proving the upgrade works in controlled conditions.
But the protocol's new builder auction mechanism needs hardening. Developers noted that existing safeguards typically activate a fallback to locally built blocks only after multiple payloads vanish. Client software must now identify and reject individual malicious builders, preventing attackers from cycling through new identities to keep winning auctions.
Client teams face a compressed timeline. Sepolia-ready software ships Sept. 29—just seven days before the fork. That's half the 14 days Ethereum typically reserves for security reviews and bug-bounty testing. Developers accepted the tighter window because Sepolia is explicitly a test bed. The real stakes arrive when Glamsterdam ships on mainnet.
