Ethereum developers have postponed the activation of the Glamsterdam upgrade on the Hoodi testnet after security firm ChainSecurity identified critical flaws in the network's gas pricing changes. The delay, announced on October 22, 2026, prevents the hard fork from going live as scheduled on Monday. ChainSecurity reported that modifications introduced by proposals EIP-8037 and EIP-8038 could allow smart contracts to permanently record failed operations that were designed to be retryable. This vulnerability arises because the new gas mechanics permit refilling or returning gas after a failed call, potentially breaking assumptions used to prevent insufficient gas griefing attacks.
The auditor stated it has already discovered 13 real-world examples of affected contracts and is engaging in responsible disclosure with those projects. Meanwhile, the Ethereum Foundation is assessing the broader scope of exposure across the ecosystem. Node operators are advised to revert to older software releases or wait for execution client teams to issue updates that cancel the scheduled fork. Preston Van Loon, a developer on the Prysm consensus client, confirmed that a release removing the upgrade from Hoodi’s schedule would follow shortly.
Glamsterdam had previously been activated on the Sepolia testnet on October 6, where it began producing blocks with a gas limit of nearly 200 million, significantly higher than mainnet's 60 million. The upgrade also introduces block-level access lists for parallel transaction checking and moves block assembly auctions into Ethereum's core rules. Developers originally aimed to ship Glamsterdam to mainnet by the end of 2026, ahead of the Hegotá upgrade expected in 2027. No new date has been set for the delayed Hoodi fork.
This incident highlights the complex interplay between economic incentives and technical security in blockchain upgrades. By altering how gas is charged for state creation and data access, the Glamsterdam proposal inadvertently disrupted established defensive patterns in smart contract code. The discovery of specific vulnerabilities before mainnet deployment demonstrates the value of rigorous pre-launch auditing on testnets like Hoodi, even when earlier tests on Sepolia appeared successful. It underscores that scaling improvements, such as increased gas limits, must be carefully balanced against backward compatibility risks for existing decentralized applications.
From an operational risk perspective, the delay forces immediate coordination among node operators, client developers, and contract auditors. The Ethereum Foundation’s ongoing assessment of exposed contracts suggests potential widespread remediation efforts may be required before any future activation. This situation serves as a cautionary tale for protocol designers: changes to fundamental resource metering mechanisms can have non-obvious security implications for high-level application logic. Stakeholders should monitor whether the revised implementation addresses the griefing vectors without compromising the intended performance gains, particularly as the timeline for mainnet integration remains uncertain.
