Ethereum developers were ready to move forward with the next phase of the Glamsterdam upgrade on the Hoodi test network. The activation was scheduled for Monday, Oct. 26 at 17:42:48 UTC [1]. That plan changed during the All Core Devs Execution meeting on Thursday. Developers decided to postpone the upgrade after security researchers identified risks in how the network handles gas for smart contracts. This delay specifically impacts the Hoodi testnet and its planned 200 million gas limit [1].

The issue stems from two specific proposals known as EIP-8037 and EIP-8038. These are part of a broader effort to make the Ethereum database more manageable as the network processes more transactions. EIP-8037 changes how the network charges users for creating new records in its database [1]. The goal is to limit the growth of that database to ensure the network can handle larger blocks in the future. However, these changes to gas accounting have created a technical conflict with contracts that are already running on the main network.

Security firm ChainSecurity published an analysis of these proposals on Oct. 13 [1]. Their findings showed that the new rules could change how existing smart contracts respond when an operation fails. In the current version of Ethereum, certain failures cause a transaction to reverse entirely. The proposed changes in Glamsterdam might allow those transactions to continue running in a way that developers did not intend.

The gas accounting shift

Gas is the fee users pay to process transactions and run smart contracts on Ethereum. Every operation has a cost. Developers write smart contracts with these costs in mind to ensure security. Some contracts are designed to catch a failed operation and then take a specific action, such as recording the failure or disabling a feature.

Developers often rely on a specific behavior where a contract runs out of gas during a failure. If the remaining gas is too low for any further actions to finish, the entire transaction reverses. This acts as a safety net. Glamsterdam changes this calculation by altering how gas is restored when certain changes are undone [1]. Under these proposed rules, gas used to create specific records can be returned to the contract after an operation fails.

This restoration of gas is the core of the problem. If a contract suddenly has more gas than it would have under the old rules, it might have enough resources to complete a failure-handling operation that previously would have been blocked. ChainSecurity warned that this could allow smart contracts to permanently record failed operations [1]. This could lead to situations where a user is unable to retry a valid operation because the contract has already marked it as a permanent failure.

Risk of permanent failures

The risk identified by researchers is often called insufficient gas griefing. In this scenario, a malicious actor provides just enough gas for a contract to start an operation but not enough for it to finish successfully. Under current rules, this often leads to a total reversal of the transaction, which protects the user or the contract state.

ChainSecurity warned that Glamsterdam’s changes could undermine these existing safeguards [2]. If gas is returned to the contract after the initial failure, the contract might continue running and execute code that it was never supposed to reach. For example, a contract could remove a claim belonging to a user or disable the option for that user to try the transaction again [2]. This would leave the user unable to complete an operation that should have been valid.

While the mechanisms for these risks have been demonstrated, researchers have not publicly established that any major production protocol is currently being exploited [1]. The findings are about how existing software would behave once the new rules are active. On Oct. 21, a security researcher using the name pcaversaccio described these risks as serious on GitHub and called for the developers to reassess the hard fork [2].

Storage cost fluctuations

The Glamsterdam upgrade does not only risk leaving contracts with too much gas. It can also create the opposite problem. ChainSecurity calculated that the cost of creating a new storage slot could increase significantly under the new rules. Specifically, if a separate gas allowance is exhausted, the cost could rise to 110,020 gas [1]. This is a sharp increase from the 22,100 gas required under the current rules [1].

This change means that a contract operating with an existing gas budget might fail while trying to carry out a normal, valid operation. The code might be written to expect a cost of roughly 22,000 gas, but the new requirement of over 110,000 gas would cause the transaction to fail unexpectedly. This mismatch between legacy code and new network rules is a primary concern for developers trying to maintain backward compatibility.

ChainSecurity reported that they identified 13 real-world examples of smart contracts that could be affected by these gas changes [2]. The firm is currently coordinating with the affected projects through a responsible disclosure process to address the vulnerabilities. They have not publicly named the projects or provided specific details about the 13 examples, but they have advised developers to review their contracts as soon as possible [2].

Unconfirmed timelines

The postponement of the Hoodi testnet has created uncertainty regarding the final release of Glamsterdam on the Ethereum mainnet. Developers had previously discussed an early December date for the mainnet activation, but that timeline depended on a successful rehearsal on the Hoodi network [2]. The upgrade had already completed a successful activation on the Sepolia testnet on Oct. 6 [1].

The Hoodi test was intended to be a major milestone because it included a planned increase in the gas limit to 200 million [1]. This increase is part of the effort to scale the network’s capacity, but it is now on hold alongside the rest of the upgrade. The Ethereum Foundation has noted that the Glamsterdam gas model could also affect other tools like wallets, indexers, and gas estimators that rely on fixed assumptions about how gas works [2].

As of now, the developers are investigating how EIP-8037 and EIP-8038 interact with the contracts already deployed on the network. There is no indication that any contracts are being exploited through these changes on the mainnet today, as the rules have not yet been implemented [1]. No replacement date has been announced for the Hoodi test or its planned 200 million gas limit [1].

Sources

1. Coindesk, Ethereum delays Glamsterdam test after security devs flag risk to existing contracts, https://www.coindesk.com/tech/2026/10/23/ethereum-delays-glamsterdam-test-after-security-devs-flag-risk-to-existing-contracts

2. Cointelegraph, Ethereum delays Glamsterdam testnet fork gas security risks, https://cointelegraph.com/news/ethereum-delays-glamsterdam-testnet-fork-gas-security-risks

Charts and the full source list: https://medium.com/@tomasrada8080/the-glamsterdam-incident-why-ethereum-halted-its-latest-upgrade-dc04fd93bd54