I keep coming back to the same odd feeling. Ethereum is racing toward a public rehearsal of Glamsterdam, and the date is now firm enough that client teams are staring at a calendar instead of a maybe. October 6 on Sepolia. That should sound like progress. It also sounds like an invitation. On a network where ether is basically free, the same design that is supposed to clean up block building can be gamed by someone who treats builder identities like disposable email accounts.
Why The Sepolia Date Suddenly Matters
Developers on the September 17 consensus call accepted the October 6 activation after looking at the latest private-network results. That is the short version. The longer version is messier, and honestly more interesting. Glamsterdam is not a cosmetic fork. It is meant to change how blocks get assembled, how payloads travel, and how much work Layer 1 can absorb without turning every slot into a traffic jam.
Sepolia comes first because it is the more controlled public stage. Hoodi is expected later, with a more open validator set. Mainnet still has no confirmed epoch. The public roadmap still points at the fourth quarter of 2026 and then politely leaves the timestamp blank. In my experience, blank timestamps are not laziness. They are a refusal to pretend a rehearsal is a launch.
The worry that dominated the call was not a mysterious consensus bug. It was economics. Cheap test ETH changes the cost of being a nuisance. On mainnet, empty blocks already exist as a paid option. On a public testnet, the same behavior can be repeated with almost no skin in the game.
What Enshrined Proposer-Builder Separation Actually Changes
EIP-7732 sits at the center of this story. The idea is straightforward even if the machinery is not. Today, a lot of block construction lives outside the protocol. Relays, builders, and proposers already cooperate, but the rules live in infrastructure rather than consensus. Glamsterdam tries to pull that relationship inside the protocol.
Builders submit bids for the right to supply an execution payload. A proposer commits to a winning bid. The builder is then supposed to release the transactions behind that bid. In the spec, builders are separate staked actors. They sign payload bids, then broadcast the matching payload envelope. That sequence is the whole point. Separate the job of packing transactions from the job of running consensus.
The protocol should decide who builds the block without turning every validator into a full-time mempool engineer.
On paper, that split is elegant. In a lab, it can look tidy. On a public testnet, the bid market meets people who do not care about elegance. They care about whether they can win the auction and then walk away.
The Cheap Builder Attack, Explained Without The Drama
Consensus developer Potuz put the risk in blunt language during the call. Test ether does not carry mainnet market value. An attacker can mint a crowd of builder identities, bid far above honest operators, win the right to produce the payload, and then withhold it. Rotate the identities. Repeat. He said he could spin up a thousand builders. He also said any teenager could try the same trick. That line is a little theatrical, sure. It is also directionally right.
This is not a story about draining mainnet balances. Nobody on that call framed it as a theft vector. It is an availability problem. Applications, indexers, wallets, and infrastructure teams use public testnets because they need living blocks. If payloads keep vanishing, the rehearsal stops being useful. It becomes noise.
Perhaps the most interesting part is how ordinary the ingredients are. You do not need a novel cryptographic break. You need cheap accounts, aggressive bids, and a client stack that is slow to treat a missing payload as a pattern rather than a glitch.
- Create many short-lived builder identities
- Outbid honest builders with uneconomic offers
- Win the commitment from the proposer
- Refuse to publish the execution payload
- Rotate identities before defenses can stick
On mainnet, repeating that loop costs real capital and real reputation. On Sepolia, the cost collapses. That is the entire warning in one sentence.
Why Existing Circuit Breakers May Not Be Enough
Clients already have fallbacks. Some wait through several missed payloads before they build locally. That is reasonable when the failure looks accidental. It is less comforting when the failure is the product. If the abusive actor can change names faster than the breaker can learn a face, the fallback never quite catches up.
Potuz said he was not aware of a universal protection that rejects individual abusive builders quickly enough. That gap matters. A circuit breaker that only notices emptiness after a streak still leaves a window. In a public environment, windows get used.
I have found that testnet security conversations often stall on a false comfort. People say the validator set is permissioned, so the blast radius is small. Sepolia does give client and testing teams more operational control than Hoodi. That helps if software breaks. It does not automatically stop a builder market from being flooded with junk bids.
Developers did not present the scenario as a confirmed exploit already running on Sepolia. They described a behavior they expect public testing to surface once outsiders can participate under ePBS rules. That distinction matters. Planning for a likely nuisance is not the same as claiming the network is already on fire.
Devnet-11 Was A Happy Path, Not A War Game
The October date moved forward because Devnet-11 completed its scheduled rehearsal. Genesis was set for September 14. The Gloas transition landed on September 16. Shortly after that, the block gas limit stepped from 60 million toward 200 million. About 84,000 validators ran across a multi-client setup carrying the same core EIP set planned for public Glamsterdam testing.
Organizers treated Devnet-11 as a controlled happy path. Deliberate attacks were left to the longer-running Platåberget environment. That split is sensible. You cannot measure a clean fork transition and a street fight on the same afternoon and then pretend the results mean the same thing.
Reports from the rehearsal said the transition completed and the gas-limit push did not cost finality. Fine. Necessary, even. It is still a test parameter, not a promise that mainnet will live at 200 million gas. Anyone treating the number as a shipping spec is getting ahead of the room.
| Stage | Role | What It Proves |
| Devnet-11 | Private happy-path fork | Clients can transition and raise gas without losing finality |
| Sepolia | First long-lived public rehearsal | Software survives outsiders and messy builder markets |
| Hoodi | Open validator environment | Staking stacks and broader participation still hold |
| Mainnet | Unscheduled | Nothing yet except a Q4 2026 target |
Glamsterdam is also about more than auctions. The design extends the execution-payload propagation window from roughly two seconds toward about nine. That extra time is supposed to help nodes ship and check larger payloads. Block-Level Access Lists and gas-pricing changes travel with the same fork. Wallets, indexers, and estimators that assumed yesterday’s constants may need new habits. Contracts that lean on fixed gas stipends deserve a second look before anyone daydreams about mainnet.
A Seven-Day Review Window Is Tight, And Everyone Knows It
The usual process wants at least fourteen days between release-ready client software and the first public testnet activation. Those two weeks exist for internal review, bounty exposure, and outside scrutiny. On the September 17 call, teams talked about September 29 as the latest date for Sepolia-ready releases. October 6 then leaves seven days. Half the preferred buffer.
Participants accepted that squeeze partly because Sepolia’s validator set is relatively centralized and recovery is easier if a build goes wrong. That is a trade. Not a magic trick. Alex Stokes pushed teams to ship earlier when they can so more reviewers get eyes on the bits. Once clients are release-ready, they can enter the bounty process immediately. Waiting until the last morning is how review becomes theater.
The compressed calendar did not appear in a vacuum. Earlier work had scars. A September 3 agenda recorded non-finality during the Devnet-8 Gloas activation across multiple consensus clients. Platåberget later knocked 12 of 13 Besu nodes offline in one scenario and slowed other stacks. Devnet-9 hit unplanned non-finality. Teams iterated. Devnet-11 looked cleaner. Cleaner is not the same as finished.
Why Testnets Still Matter More Than The Marketing Suggests
People outside core development sometimes treat testnets like disposable sandboxes. They are disposable in one sense. They are not disposable in another. A lot of production software is validated against whatever Sepolia is doing this month. If blocks become unreliable just as ePBS goes live in public, app teams do not get a clean signal. They get a shrug.
That is why the builder warning is not a sideshow. An upgrade designed to raise Layer 1 capacity only helps if the public rehearsal still produces usable history. Empty slots teach you something about griefing. They teach you almost nothing about wallets, indexers, or gas estimators under the new rules.
I’ve found that the teams who complain loudest about “just a testnet” are often the same teams who file tickets when a staging chain stops finalizing. Fair enough. Staging is where you want the bruises.
Permissioned Validators Help, They Do Not Erase Incentives
Sepolia’s validator set is permissioned and steered by client and testing groups. Hoodi is the more open staking classroom. That difference is why Sepolia is the first public stop. If the first long-lived Glamsterdam deployment gets weird, operators have more levers.
Levers are not the same as immunity. Builder identities and validator identities are not one object. You can keep the proposer set tidy and still watch the bid market fill with disposable actors. The attack described on the call lives in that gap.
Control over who attests is not automatically control over who bids.
If client software can identify abusive bidding patterns quickly, Sepolia stays useful. If the only answer is “wait a few missed payloads, then build locally,” a motivated nuisance can keep the network in a limp. Not dead. Just limp enough to waste everyone’s week.
Gas Limits, Bigger Payloads, And The Temptation To Overread A Test
The jump toward a 200 million gas limit on Devnet-11 is catnip for headlines. Of course it is. Capacity is the part of Glamsterdam that sounds like a product announcement. The protocol work around payload timing is the part that actually makes larger blocks less of a coordination nightmare.
Nine seconds is not a slogan. It is an attempt to give gossip and verification room to breathe. Block-Level Access Lists try to make state access more predictable. Gas repricing tries to stop some operations from being priced like it is still 2021. None of that is free. Estimators that hard-code old constants will look clever until they look broken.
A separate review of smart-contract risk already flagged contracts that depend on fixed stipends or gas-sensitive control flow. That should not surprise anyone who has watched an upgrade from the application side. The chain can be “fine” while a particular pattern quietly fails. Public testnets exist so those patterns show up before money does.
Glamsterdam public path, simplified: Client releases by late September Sepolia fork on October 6 Hoodi timing depends on Sepolia Mainnet epoch still unset
What “Any Teenager Can Do This” Really Signals
That phrase will get quoted because it is sharp. I would not treat it as an insult to teenagers or a boast about chaos. It is a reminder that the barrier is operational, not academic. If the defense assumes attackers are rare specialists, the defense is aimed at the wrong room.
Public testnets attract curiosity. Some of it is constructive. Some of it is bored. ePBS turns boredom into an auction. If bids are cheap to inflate and payloads are optional after the win, you do not need a research lab. You need persistence.
So the practical question is not whether someone might try. Someone will try because the setup advertises itself. The practical question is whether clients can isolate a bad builder fast enough that the rest of the network keeps producing useful blocks.
Client Teams Now Own An Awkward Clock
September 29 is not a ceremonial checkpoint. It is the last comfortable morning to put binaries in front of reviewers. Seven days after that, Sepolia is supposed to fork. If a serious client bug appears on day five, the options get ugly: slip the date, ship with a known bruise, or lean hard on Sepolia’s recovery story.
I would rather see earlier releases and a slightly boring October 6 than a heroic last-minute patch. Boring forks are underrated. The industry has had enough cinematic incidents for one decade.
- Publish Sepolia-ready clients as early as possible
- Expose those builds to bounty review immediately
- Add builder-level defenses, not only streak-based fallbacks
- Watch bid markets for identity churn after activation
- Let Hoodi wait if Sepolia is not actually usable
None of that is glamorous. All of it is how you keep a public rehearsal from turning into a week of empty blocks and Slack archaeology.
Mainnet Is Still A Target, Not A Timestamp
It is worth saying this twice because markets love a date. Ethereum has not scheduled Glamsterdam on mainnet. The draft incident-response plan still leaves activation fields blank while listing the roles that will be filled later. That is the grown-up version of “we will know when we know.”
Hoodi remains the logical second public stage because it is where open validation and staking stacks meet the new rules. Developers tied Hoodi’s timing to Sepolia’s health. If the first public network is chaotic, later dates move. That should be obvious. It still needs saying, because a successful Devnet-11 screenshot can create a false sense of a locked runway.
The upgrade’s pitch remains consistent: more Layer 1 capacity, a cleaner split between proposing and building, and pricing that does not punish growth with yesterday’s quirks. The prerequisite remains consistent too. Multi-client testing has to look boring in public, not only in a curated lab.
A Few Things I Would Watch After October 6
First, payload miss rates that cluster around fresh builder keys. A random miss is weather. A pattern of new names and missing envelopes is a campaign.
Second, how quickly each client falls back to local building, and whether that fallback becomes the default lifestyle of the network. A chain that “works” only because everyone gave up on the auction is not demonstrating ePBS. It is demonstrating a safety hatch.
Third, whether application teams can still trust Sepolia as a rehearsal surface. If explorers, bridges, and wallets start treating the fork week as unusable, the public test has failed even if finality metrics look acceptable on a slide.
Fourth, the tone of the next consensus call. If the conversation shifts from “this might happen” to “here is the mitigation that shipped,” the process is working. If it shifts to date slipping without a clear owner, the calendar got ahead of the software.
The Human Read On A Very Technical Warning
Ethereum is trying to move a market that already exists into consensus rules. That is ambitious in a good way. Markets, even protocol markets, attract people who optimize for winning the round rather than serving the chain. On mainnet, money disciplines that impulse. On Sepolia, the discipline is mostly social and software-defined.
So yes, the October 6 date is real enough to plan around. No, it is not a victory lap. The interesting work now is unglamorous: builder-aware circuit breakers, faster identity hygiene, and enough review days that a surprise in the bid market does not become a surprise in production tooling.
If the public rehearsal stays noisy, Hoodi waits. If it stays boring, the roadmap can keep its fourth-quarter ambition without pretending a testnet auction is the same thing as a mainnet economy. That difference is the whole plot.
And if someone does spin up a thousand builders on day one, I hope the logs are detailed. Not because chaos is entertaining. Because that is how you learn whether ePBS is ready to live outside the lab.
