Ethereum’s Glamsterdam Upgrade Hits a Security Snag

Home » Ethereum’s Glamsterdam Upgrade Hits a Security Snag

Quick answer: Ethereum’s next major network upgrade, Glamsterdam, is aiming for a public testnet launch on Sepolia on October 6, 2026, after slipping past two earlier target dates because of consensus bugs found across nine sequential test networks. The latest wrinkle showed up on September 17, during Ethereum’s All Core Developers Consensus call, when developer Potuz warned that anyone could spin up throwaway “builder” identities on the free-to-use testnet, win the right to build blocks under Ethereum’s new proposer-builder separation rules, and then simply refuse to deliver them — stalling finality without spending a cent. It’s a testnet-specific problem for now, tied to the fact that test ETH has no real value, but it’s forcing developers to think harder about a mechanism that’s supposed to make mainnet more resilient, not less. Client teams have until September 29 to ship updated software, leaving roughly a week of review before the fork — half the usual runway.

Editor’s Update: September 29, 2026. As of the latest coverage we could verify (September 27), the October 6 Sepolia target at 13:53 UTC still stands, with no delay announced. Reports on Devnet-11 say it completed the fork transition and lifted the gas limit from 60 million to 200 million while maintaining finality, a clear improvement on the Devnet-9 finality failures described below. Ethereum Foundation researcher Toni Wahrstätter described the parallel-execution work (EIP-7928) as “approaching the final mile.” The builder-abuse concern around EIP-7732 has no agreed fix yet, and we couldn’t confirm whether client teams met today’s September 29 release deadline. Mainnet has no confirmed date; the roadmap points to Q4 2026 and December remains a discussion point only.

Editor’s Update: September 30, 2026. The Ethereum Foundation’s testnet announcement (published September 17) confirms Sepolia activation for October 6, 2026 at 13:53:36 UTC (epoch 353,024), with Hoodi and mainnet epochs still to be announced. The Crypto Times reports that several Sepolia-compatible client releases are now out, including Prysm 7.2.0, Teku 26.9.1 and Lodestar 1.49.0 on the consensus side, and Besu 26.9.0, Erigon 3.7.0, go-ethereum 1.17.6 and Reth 2.7.0 on the execution side, so part of the September 29 client deadline mentioned above appears to have been met. The Foundation’s release table was still missing entries for Lighthouse, Nimbus, Grandine and Ethrex at the time of that report. We found no announced delay and no agreed fix for the builder-abuse concern.

What Glamsterdam Actually Changes, and Why It Matters Beyond Ethereum Itself

Every Ethereum upgrade gets a cute name and a long list of technical line items, and Glamsterdam is no exception. But strip away the acronyms and two changes stand out. The first is a jump in block capacity: developers have been testing a block gas limit of 200 million, more than three times today’s 60 million ceiling. The second is the underlying reason that jump is even possible — block-level access lists, a mechanism that lets validators fetch data and verify unrelated transactions in parallel instead of working through a block one instruction at a time.

That second piece sounds dry, but it’s the part that actually matters for anyone using Ethereum day to day. Sequential processing is why gas fees spike the moment network demand rises — validators can only get through so much work per second, so when everyone wants block space at once, people start outbidding each other. Parallel execution raises that ceiling meaningfully. Nethermind’s execution client processed 570.7 billion gas in three minutes and fifteen seconds during the most recent devnet run — call it 2.9 billion gas per second — which is the kind of throughput that starts to matter when you’re trying to keep fees predictable during a busy trading day.

This is also, in plain terms, a story about Ethereum’s layer-2 ecosystem. Rollups inherit Ethereum’s security but still depend on the base layer having enough room to post their data cheaply. When we covered Ethereum’s last major upgrade, Fusaka, the throughline was the same: base-layer capacity decisions ripple straight through to what it costs to use Arbitrum, Base, or Optimism. Glamsterdam is the next link in that chain, and if you want the deeper mechanics of how rollups turn that base-layer capacity into cheaper transactions, we’ve broken down how those rollups actually work under the hood elsewhere on the site.

Nine Devnets and Two Missed Deadlines

Here’s where the story gets less tidy. Glamsterdam was originally supposed to reach the Sepolia public testnet on August 3, with mainnet activation penciled in for the first quarter of 2026. Neither happened. Between late March and early September, Ethereum’s core developers ran nine sequential “devnets” — small, disposable test networks used to shake out bugs before anything touches real infrastructure — and several of them found exactly the kind of problems you’d rather catch early.

Devnet-8 exposed a consensus-layer defect serious enough that, under the wrong conditions, a block repeating its parent’s hash could have stopped the entire network from agreeing on anything. Devnet-9, launched September 1 with roughly a thousand validator nodes, simply failed to finalize blocks the way it was supposed to. For a chain whose mainnet has finalized blocks without interruption for years, that’s not a rounding error — it’s the kind of failure that makes staking providers nervous, and several of them reportedly asked for at least one full day of stable devnet operation before developers commit to any fork date.

A separate headache came from EIP-8037, the proposal that reprices gas for creating new state on the network. Getting the execution and consensus layers to agree on the new pricing logic required every execution client team — Geth, Nethermind, Besu, and the rest — to revise their implementations. That’s not a quick patch; it’s the kind of change that has to be re-tested from scratch across every client to make sure nobody’s version of Ethereum disagrees with anyone else’s about how much a transaction should cost.

By the time Devnet-11 launched in mid-September, things looked considerably more stable, which is what let developers set the current October 6 target at 13:53 UTC. But “considerably more stable” and “done” aren’t the same thing, and the very next developer call surfaced a new problem entirely.

The New Wrinkle: Builder Abuse on a Testnet With Nothing to Lose

How Proposer-Builder Separation Is Supposed to Work

Glamsterdam includes EIP-7732, which enshrines proposer-builder separation directly into Ethereum’s protocol rules. In plain English: instead of the validator that’s due to propose a block also building it, specialized “builders” compete by submitting bids for the right to supply that block’s contents. The highest bidder wins, the validator proposes it, and everyone moves on. This is already how a large share of Ethereum blocks get built today through off-chain relay services — Glamsterdam’s contribution is baking that process into the protocol itself, cutting out the third-party relays and reducing the amount of trust the system has to place in them.

It’s a sensible design on mainnet, where real ETH is on the line and builders have genuine financial skin in the game. Sepolia is a different story, and that’s exactly the gap that got flagged.

Why a Free Testnet Breaks the Incentive Model

During the September 17 All Core Developers Consensus call, consensus developer Potuz laid out the problem bluntly: because Sepolia’s test ETH carries no real economic value, there’s nothing stopping an attacker from spinning up an enormous number of disposable builder identities, submitting inflated bids to win the right to build blocks, and then simply never delivering the promised payload. “I can just spin up a thousand builders,” he said, adding that “any teenager can do this.” Each failed delivery disrupts payload handoff and, multiplied across enough attempts, threatens to stall finality on the network entirely.

On mainnet, this kind of behavior would be self-defeating — a builder that wins an auction and then withholds the block is burning real money for no return. On a public testnet where anyone can mint test ETH for free, that economic guardrail simply doesn’t exist. Some client teams have built in circuit breakers that fall back to a locally built block when a promised payload doesn’t show up, but developers on the call acknowledged those safeguards might not hold up against a sustained, deliberate attack. No universal fix had been agreed on by the time the call wrapped.

It’s worth being precise about what this is and isn’t. This isn’t a vulnerability that puts anyone’s mainnet funds at risk today — Glamsterdam hasn’t activated anywhere near real value yet, and Sepolia’s validator set is permissioned, meaning operators retain the ability to step in manually if things go sideways. What it is, though, is a reminder that enshrining a mechanism like proposer-builder separation into the base protocol raises the stakes on getting the incentive design right, since there won’t be a relay operator standing between users and a misbehaving builder once this ships to mainnet.

A Compressed Timeline Heading Into October

The practical consequence of finding this problem in mid-September, with an October 6 fork already targeted, is a tighter-than-usual runway. Client teams are expected to release updated software by September 29, leaving roughly seven days for the community to review it before Sepolia forks — about half of the fourteen-day window developers normally prefer for a change of this magnitude. After Sepolia comes Hoodi, a second public testnet with a fully open validator set that will stress-test the upgrade under conditions closer to mainnet. No mainnet activation date has been confirmed. December has come up in developer discussions as a possibility, but multiple people involved have been careful to describe it as exactly that — a possibility, not a scheduled outcome. Given how the last two deadlines went, that caution seems earned.

What This Means If You Hold or Trade ETH and L2 Tokens

None of this changes anything about Ethereum today. Mainnet keeps running exactly as it has, and nothing here affects the security of funds sitting in a wallet, an exchange, or a DeFi protocol right now. What it does affect is expectations. If you’ve been tracking Glamsterdam as a catalyst for lower fees or higher throughput on a particular timeline, the honest read is that the timeline keeps moving, and it’s moving for a reason that should reassure you rather than worry you — developers are finding and fixing serious problems before they reach real money, not after.

There’s also a broader lesson here for anyone evaluating layer-2 tokens or DeFi protocols that lean on Ethereum’s roadmap in their marketing. “Ethereum is about to get much cheaper” has been a recurring pitch for years, and it’s often technically true on a long enough timeline while being wrong about the specific date. Glamsterdam’s repeated delays are a useful case study in why protocol roadmaps deserve more skepticism than the average X thread gives them, especially when a project’s valuation thesis depends on an upgrade landing by a particular quarter.

As always, this is market and technical analysis, not financial advice. Protocol upgrades carry execution risk right up until the moment they’re live on mainnet and battle-tested, and anyone trading around an upgrade narrative should size positions with that uncertainty in mind and do their own research before acting on any of it.

Frequently Asked Questions

What is the Ethereum Glamsterdam upgrade?

Glamsterdam is the Ethereum network upgrade scheduled to follow Fusaka, primarily aimed at increasing block capacity through parallel transaction processing (via block-level access lists) and enshrining proposer-builder separation (EIP-7732) directly into the protocol. It’s currently targeting a Sepolia testnet launch on October 6, 2026, with no confirmed mainnet date.

What is “builder abuse” in the context of this upgrade?

It refers to a scenario where an attacker creates many disposable “builder” identities on a testnet, wins the right to build blocks by bidding aggressively, and then withholds the promised block contents. Because test ETH has no real value, attackers face no financial penalty for doing this repeatedly, which threatens to disrupt the testnet’s ability to finalize blocks.

Does this affect Ethereum mainnet or put my funds at risk?

No. This issue has only been observed and discussed in relation to the Sepolia public testnet, which uses valueless test ETH. Ethereum mainnet continues operating normally, and Glamsterdam has not activated there.

When will Glamsterdam go live on Ethereum mainnet?

No confirmed date exists as of this writing. Developers have discussed a possible December 2026 window, but they’ve explicitly framed that as speculative rather than scheduled, especially after the upgrade already missed an August 3 Sepolia target and a first-quarter-2026 mainnet target.

Why does a base-layer Ethereum upgrade matter for DeFi and layer-2 tokens?

Most DeFi activity today happens on layer-2 networks like Arbitrum, Base, and Optimism, which post data back to Ethereum’s base layer. Increases in Ethereum’s base-layer capacity, like the block gas limit changes being tested in Glamsterdam, directly affect how cheaply those rollups can operate and how much room the whole ecosystem has to grow without fee spikes.

Key Takeaways

  • Ethereum’s Glamsterdam upgrade is now targeting an October 6, 2026 launch on the Sepolia testnet, after missing an original August 3 target following bugs found across nine sequential devnets.
  • On September 17, developers flagged a “builder abuse” risk specific to testnets: attackers can spin up free, disposable builder identities to win block-building auctions under EIP-7732 and then withhold the blocks, without facing any real financial penalty.
  • Client teams face a compressed timeline, needing to ship updated software by September 29 for roughly a week of review before the fork — about half the usual runway.
  • No mainnet activation date is confirmed; December 2026 has been discussed only as a possibility.
  • The upgrade’s core payoff is a tripling-plus of block gas capacity (60 million to a tested 200 million) through parallel transaction processing, which matters most for keeping layer-2 fees low as DeFi activity grows.
  • This is a testnet-stage issue with no current impact on mainnet funds or DeFi protocols in production today.

If you want the fuller picture of how Ethereum’s upgrade cadence has actually played out in practice, our look at what happened to gas fees nine months after Fusaka is a useful next read, and it’s worth revisiting as Glamsterdam approaches its own testnet debut.

Leave a Reply

Your email address will not be published. Required fields are marked *

© Copyright 2026 FiscalFrontier
Powered by WordPress | Mercury Theme