Ethereum’s core developer call on Thursday produced a date and a warning, and the warning is the more interesting half. Glamsterdam, the network’s largest upgrade since the Merge, gets its public dress rehearsal on the Sepolia testnet on 6 October. And on that rehearsal, according to consensus developer Potuz, “any teenager” could stall the chain.
The mechanics are almost insultingly simple. Glamsterdam pulls the relationship between validators and specialised block builders into the protocol itself. Builders assemble blocks, bid to supply them, a validator accepts the winning bid, and the builder is then expected to reveal the transactions it promised. On Sepolia, those bids are denominated in test ether, which is free. Hence the quote from the call: “I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads.” Win every auction with money that costs nothing, deliver nothing, and come back under a fresh identity when somebody tries to block you.
No mainnet funds are at risk. That is not the point. The point is what this says about testing, and crypto gaming is the industry that most badly needs to hear it.
TL;DR
- Ethereum confirmed 6 October for Glamsterdam’s Sepolia test, warning that attackers with free test ether and disposable builder identities could win block auctions repeatedly and then withhold the payloads.
- A testnet copies a network’s rules exactly and falsifies its prices completely. Whatever is secured by code survives that copy. Whatever is secured by cost does not survive it at all.
- The failure being discussed this week is the cheap error: an attack that only works because bidding is free. The expensive error is its mirror image, an attack that only appears once the prize is worth taking, which no testnet can ever produce.
- “Live on testnet” proves your contract compiles and your front end talks to the chain. It proves nothing about what happens when there is real money in the pot.
- This is the case for provable fairness as a code-enforced guarantee: a Chainlink VRF proof holds whether or not cheating you was ever profitable.
A testnet copies the rules and lies about the price
A test network is a faithful reproduction of a live one. Same clients, same consensus rules, same fork logic. That fidelity is the entire value proposition, and for most of what developers need it is genuine: if a state transition is invalid on Sepolia it is invalid on mainnet. But one falsification is deliberately built in, and it is not a bug. The money is free. It has to be, or nobody could afford to test anything.
Which gives you a clean dividing line, and it is the most useful thing to take from this week’s news. Mechanisms whose safety is enforced by code transfer perfectly onto a testnet, because code does not know what its inputs are worth. Mechanisms whose safety is enforced by cost do not transfer at all, because their security parameter has been set to zero on the way in.
Proposer-builder separation is squarely the second kind. An auction is not a clever data structure, it is a device for making people reveal what something is worth to them, and it only functions if a bid hurts. Set the price of bidding to zero and you have not weakened the auction, you have deleted it. The environment purpose-built to prove that ePBS works is the one environment in which it definitionally cannot.
Two ways the copy misleads you, and the second one is worse
Everyone is currently discussing the first failure mode, because it is the one you can watch happen. Free ether produces attacks that would be senseless on mainnet, where overbidding for blocks you never deliver burns real capital and real standing with validators. Call it a false positive. It is disruptive but cheap, because the network notices immediately and the developers have already named it out loud on a public call.
The failure mode nobody mentions is the reverse, and it is the one that costs money. A testnet cannot generate the attacks that only exist when the prize is real. No one griefs a testnet raffle, because there is nothing in it. No one assembles capital to manipulate a market that settles in worthless units. No one spends a week reading your contract for a payout denominated in nothing.
So your clean testnet run has two readings. The generous one is “this survived adversarial conditions”. The accurate one is “nobody in the world had a financial reason to attack this, and nobody did”. Those are not the same finding, and only one of them is evidence. An absence of attack where attacking pays nothing is not a security result, it is a tautology with a green tick next to it.
Identity is a cost mechanism too
The proposed mitigation deserves the same scrutiny. Current safeguards only fall back to locally built blocks after several payloads have already gone missing, so clients will need to identify and reject individual builders, stopping an attacker returning under a new name.
That is a reputation system, and reputation is another mechanism secured by cost. It works when an identity is expensive to acquire and worth keeping, which on mainnet it is: a builder that burns its name burns a relationship with the validators it wants blocks from tomorrow. On a network where identities are free, “reject the bad builder” and “the bad builder reappears” are the same sentence. The attack described on the call is a sybil attack wearing a block auction as a costume.
Crypto gaming’s favourite empty sentence
Which brings this home. “Live on testnet” is the most quietly meaningless phrase in crypto gaming, and it appears in roughly every deck and every launch thread. It is not a lie. It is a claim about the wrong thing.
A testnet deployment demonstrates that your contract compiles, your draw resolves, your randomness callback lands, and your front end signs a transaction and shows a result. All useful, all necessary, and none of it touching the only question that decides whether a game survives contact with users: what people do once the pot is worth attacking.
Look at how gaming contracts actually die and the failures are overwhelmingly economic rather than syntactic. An entrant buys enough of the field to shift the expected value for everyone else. Someone front-runs the moment a result becomes predictable. An operator discovers that stalling a payout is cheaper than making it. Every one of these needs money on the table to appear at all, which means every one of them is invisible in exactly the environment where projects go looking for confidence.
Which half of your fairness claim survives a free network?
That is the question the Glamsterdam warning hands to anyone making a fairness claim, and it is a better diagnostic than an audit badge. “Our house has never manipulated a result” is a cost claim. It describes incentives that held while nobody had sufficient reason to test them. “The winning entry was selected by a verifiable random function whose proof is checked on-chain against a published key” is a code claim. It does not improve when the operator is honest and it does not degrade when the pot grows large enough to tempt them, because the operator was never an input.
That distinction is the whole reason Satoshie is built on Chainlink VRF rather than on a promise and a track record. Our raffles and coinflips run on Base mainnet, the VRF coordinator address is fixed in the deployed code where anyone can read it before staking anything, the randomness is produced off-chain and verified on-chain, and there is no path by which we choose a winner. That guarantee is the kind that survives the copy: exactly as true on a testnet, and exactly as true if the prize were a hundred times larger, because its security never rested on anyone’s arithmetic about whether cheating pays.
What we are not claiming
Three caveats, because the argument cuts at us too.
Not everything we depend on is code-enforced. Prize funding, our own operational liveness, and Base’s sequencer (Coinbase-operated today, with Ethereum L1 forced inclusion as the backstop) are economic and operational guarantees, and they inherit every criticism above.
This is also not an argument against Glamsterdam, which we are looking forward to. A block gas limit heading toward 200 million makes on-chain gaming cheaper, and a core developer standing up on a public call to describe the exact way to break his own upgrade’s rehearsal is the process working, not failing. Compare that to how a centralised casino discloses the flaws in its internal testing.
And cost-secured mechanisms are not inferior. Most of crypto is built from them, proof of stake included. The narrow claim is that they cannot be validated where cost is zero, so they need a different sort of evidence: economic modelling, incentive-compatibility analysis, bounded rollouts with real value at risk.
Three questions worth asking
Ask them of us, and of anyone else who wants your stake:
- Which part of your fairness guarantee is enforced by code, and which part is enforced by it currently not being worth anyone’s while to break?
- What did your testnet actually prove, stated without the word “works”?
- What would an attacker have gained by attacking it, and if the answer is nothing, why is a clean run evidence of anything?
A teenager with free ether can stall the dress rehearsal for the largest blockchain upgrade in three years. The lesson is not that testnets are worthless. It is that they exercise one half of a system and are structurally blind to the other, and this industry keeps citing the half that was never in doubt.
Verification is not a forecast about behaviour. It is the removal of behaviour from the question.
