Ethereum postpones Glamsterdam on Hoodi testnet after ChainSecurity flags gas risks
In brief
- Ethereum Foundation confirmed Oct. 22 that Glamsterdam's Oct. 26 Hoodi activation won't go ahead as planned.
- ChainSecurity's Oct. 13 report flagged risks from gas-accounting proposals EIP-8037 and EIP-8038.
- ChainSecurity said it found 13 real-world examples of affected deployed contracts.
- Hoodi's planned gas limit increase to 200 million is also suspended.
- No Glamsterdam mainnet date has been finalized.
What happened on the Oct. 22 call
The decision followed discussions at the Oct. 22 All Core Developers Execution meeting, where participants agreed to investigate EIP-8037 further and look at how it interacts with existing mainnet contracts. Christine Kim, founder of research firm Protocol Watch, first disclosed the cancellation. She urged affected Hoodi node operators to revert to older software or install updated execution clients.
The pause also suspends a planned increase in Hoodi's gas limit to 200 million (it was meant to support testing of larger transaction volumes). Hoodi's existing transaction history isn't affected.
ChainSecurity's warning
The postponement follows an Oct. 13 report from ChainSecurity, which identified potential vulnerabilities in two proposed changes. EIP-8037 introduces a separate gas reserve for creating blockchain state, while EIP-8038 changes the cost of accessing and modifying existing state. Both are meant to increase transaction capacity by aligning gas charges more closely with the resources smart contracts consume.
The problem is code that's already deployed.
ChainSecurity warned the changes could undermine safeguards that existing applications use to separate failed transactions from operations that should stay eligible for retry. Under Glamsterdam's proposed rules, contracts that previously would have reverted could instead record an operation as permanently unsuccessful. The firm said attackers could deliberately trigger insufficient-gas failures, which could stop users from retrying otherwise valid operations. It flagged defi apps that handle withdrawals, batched transactions and other automated failure recovery.
The firm put a number on what it had found so far:
ChainSecurity said they “already found 13 real-world examples,” adding that it was conducting responsible disclosure with affected projects.
ChainSecurity urged developers to review their contracts immediately while the Ethereum Foundation investigates how many applications are exposed.
What it means for the 2026 timeline
CryptoSlate reported that the setback threatens Ethereum's push to ship Glamsterdam before the end of 2026. That target has already slipped once. In February, the Ethereum Foundation aimed for the first half of 2026, with the Hegotá upgrade expected later in the year. Developers had looked at several December activation dates, but they haven't finalized a mainnet schedule.
Frequently asked questions
Why was Glamsterdam postponed on the Hoodi testnet?
Developers agreed at the Oct. 22 All Core Developers Execution meeting to investigate EIP-8037 further and how it interacts with existing mainnet smart contracts. The step came after an Oct. 13 ChainSecurity report flagged potential vulnerabilities in proposed gas-accounting changes.
What do EIP-8037 and EIP-8038 change?
EIP-8037 introduces a separate gas reserve for creating blockchain state, while EIP-8038 changes the cost of accessing and modifying existing state. Both aim to increase transaction capacity by aligning gas charges more closely with the resources smart contracts consume.
What risk did ChainSecurity warn about?
ChainSecurity warned the changes could undermine safeguards apps use to tell failed transactions from operations that should remain retryable. It said attackers could deliberately trigger insufficient-gas failures, which could prevent users from retrying otherwise valid operations.
