Glamsterdam Ran in Public, and Lost Finality on Day One

The short version

• Glamsterdam activated on a publicly joinable network for the first time on 20 August, when the Platåberget testnet forked — then lost finality on a builder-deposit bug in three consensus clients.
• ACDC #185, same day, put Sepolia and Hoodi fork dates on the table. Neither confirmed.
• EIP-7610 is out of Glamsterdam, marked Declined in the meta-EIP. Its replacement, EIP-8253, permanently kills a fixed set of counterfactual addresses.
• Block-level access lists were priced for the first time: ~47% of a block's data gas, still outside fee accounting.
• Two application-layer losses: Allbridge to a forged CCTP message aged 24 days, Term Finance to bought votes.

Platåberget forked and lost finality — 20 August

• First public network running the full Glamsterdam set: EIP-7732 (ePBS), EIP-7928 (BALs), EIP-8007's repricing bundle targeting a ~200M gas floor, EIP-7954 (contracts 24 → 64 KiB, initcode 48 → 128 KiB), EIP-7688 (forward-compatible consensus containers). Meant to run months, not days.
• Lighthouse, Prysm and Teku all mishandled builder deposits after the fork, with a caching bug involved, and the network temporarily lost finality. Reported via the ACDC #185 call, not from call notes; treat as second-hand.
• Fixes reportedly cut fork transition time from ~20 seconds to ~500 ms. ePBS's builder deposit flow is new consensus surface, and that breaks first.

Sepolia proposed for 28 September, undecided — 20 August

• Sepolia: epoch 351232, slot 11239424, 28 September 2026 14:44:48 UTC.
• Hoodi: epoch 132352, slot 4235264, 26 October 2026 17:42:48 UTC, conditional on devnet stability.
• Client teams signalled agreement without objection; the call explicitly did not decide. ACDC #186 on 3 September is the next opportunity. Lido and Optimism asked for a stable devnet period first — recorded, not a blocker.
• No mainnet date exists.

EIP-8253 makes some addresses permanently undeployable — 20 August

• EIP-7610 (revert creation on non-empty storage) is Declined in EIP-7773. EIP-8253 replaces it — Draft, created 5 May 2026, no fork named; call reporting points at Hegotá.
• Same problem, different mechanism:
  • EIP-7610: permanent runtime check at every contract creation.
  • EIP-8253: one-time irregular state transition at a fork block, setting nonce = 1 on every account with empty code, zero nonce, and non-empty storage.
• EIP-684 already forbids creation where nonce != 0, so that one write closes those addresses forever.

Block-level access lists got priced — 18 August

• Fei Wu (EF internship), Data Metering, BAL Decomposition, and Bundle Pricing Under EIP-7999. EIP-7928 ships BALs with no fee accounting at all.
• Runtime BAL ≈ 119,944 bytes per block = 1.919M data gas at 16 gas/byte = 47.4% of a 4.05M data-gas block.
• By origin: 11.4% direct state creation, 37.9% access co-produced by state-creating transactions, 50.7% plain non-state execution.
• Conclusion: BAL is induced load, not independent demand, so pricing it separately double-charges. Proposal is BAL-inclusive parent prices under EIP-7999.

Two application-layer losses — 19 and 23 August

• Allbridge, ~$191,000. Per SlowMist: on 26 July the attacker called Circle's MessageTransmitterV2.sendMessage on Polygon with a hand-built message claiming 1,000,000 USDC. No USDC was burned; Circle attested it anyway. 24 days later, six seconds after the Base router received ~191,000 USDC, the attacker drained it with an Aave flash loan. The bug is not in CCTP — Allbridge treated "Circle signed this" as "a deposit occurred". An attestation proves a message was signed, never that the event it describes happened.
• Term Finance, $8.5M. ~2,843 ETH and 1.6M DAI out of fixed-rate lending vaults, confirmed by CertiK and PeckShield. Seeded with 2 ETH from Tornado Cash, the attacker took 100% of voting power on four of five USDC strategy vaults and ~91% of the ETH meta-vault, then used governance as designed. Where voting power is purchasable and quorum is a fraction of circulating supply rather than of anything scarce, access control has a market price.

Hegotá's consensus agenda starts filling — 20 August

• Also on ACDC #185: EIP-8333 (checkpoints aligned to epoch boundary blocks), Engine API sync status, a shorter CL block retention window, finality-gap behaviour. FOCIL (EIP-7805) is still the consensus headliner. A builder-preferences Beacon API endpoint was flagged critical for DVT clusters. Next execution call: ACDE #244, 27 August.

Why it matters

• Two assumptions break on Platåberget today:
  • Hardcoded maximum gas limits — the EF warns wallets, indexers and gas estimators break outright.
  • The flat 21,000-gas transfer. To an existing account it still costs 21,000; one that creates an account carries a separate state-gas charge.
• For contract authors that reaches into metering code, not just tooling:

(bool ok, ) = target.call{gas: 2300}("");     // stipend-sized budgets
require(gasleft() > 100_000);                 // gasleft() excludes the state reservoir
uint256 fee = 21_000 * tx.gasprice;           // refund and relayer accounting

• EIP-8253's deadline is a fork block, not a transaction. Anyone holding an undeployed committed address — CREATE2 factory outputs, counterfactual smart accounts, deterministic proxies — needs to know now whether it has non-empty storage with empty code.
• Nothing else this window changes EVM semantics. Both losses are design failures, not compiler or protocol ones.

Worth watching

• Does Sepolia hold at 28 September? ACDC #186 on 3 September confirms, pushes, or splits it. The input is whether Platåberget stabilises.
• Do BALs get priced before Glamsterdam ships? Unpriced means ~120 KB per block nobody pays for. If pricing arrives in Hegotá via EIP-7999, a third fee dimension lands right after the second.
• Which fork EIP-8253 lands in. The text names none; only call reporting points at Hegotá. Until a meta-EIP lists it, the fork block for that state transition is unknown.