x
Ethereum core developers have hit a major snag in their roadmap after postponing the long-awaited Glamsterdam upgrade on the Hoodi testnet. Originally scheduled for activation on 26 October 2026, the upgrade was abruptly called off following critical security warnings from blockchain researchers.
The sudden pause came after security audit firm ChainSecurity uncovered serious vulnerabilities in how proposed gas accounting changes interact with live smart contracts. With 13 real-world smart contracts already identified as vulnerable, the core engineering team chose to halt the rollout to prevent potential exploits on mainnet, as detailed in the latest CryptoSlate reporting on the delay.
The immediate catalyst for the postponement was a series of findings regarding two Ethereum Improvement Proposals: EIP-8037 and EIP-8038. EIP-8037 introduces a dedicated state-gas reservoir for contract creation, whilst EIP-8038 updates execution costs for accessing existing state.
While these proposals aim to align gas costs with actual node resource usage and increase transaction capacity, they inadvertently alter how gas is refunded and tracked during complex transactions.
Protocol Watch founder Christine Kim raised the alarm shortly before the formal announcement, notifying testnet operators on X to revert their nodes or install client builds that cancel the scheduled activation epoch.
The decision was formalised during All Core Developers Execution meeting #248 and subsequently confirmed in an official Ethereum Foundation post. Along with pausing the Glamsterdam activation, developers suspended a planned testnet gas limit increase to 200 million, which was meant to benchmark high-throughput scaling scenarios.
At the heart of the issue is a flaw that security analysts describe as a variation of "insufficient gas griefing".
In Ethereum's current execution model, smart contracts handling withdrawals, batched transactions, or fallback routines often check remaining gas ( gasleft() ) after calling an external contract. If the target contract runs out of gas, the caller detects the failure and gracefully reverts the entire transaction so a user can safely try again later.
However, Glamsterdam's new gas accounting rules introduce scenarios where spent gas unexpectedly refills during execution. Under EIP-8037, state creation charges draw from a separate reservoir. If an intermediary contract reverts or if a persistent storage slot is cleared, a last-in, first-out (LIFO) refill mechanism restores execution gas directly to the caller's balance.
This unexpected gas refill creates a dangerous side effect: a failure handler that previously would have run out of gas and reverted can now complete its execution. Consequently, an attacker can intentionally supply insufficient gas to force a subcall to fail, whilst the refilled gas allows the main contract to record the failure as permanent. This permanently blocks valid user operations and locks out retry mechanisms across decentralised finance applications.
ChainSecurity confirmed that its team had already identified 13 real-world contracts affected by this behaviour and initiated responsible disclosure procedures with the impacted projects.
This postponement represents another setback for Ethereum's ambitious 2026 development schedule. Glamsterdam was originally targeted for release during the first half of 2026 before slipping to December. Core developers had tentatively eyed activation dates of 1, 8, or 9 December, subject to smooth testing on Hoodi.
With the Hoodi testnet activation now indefinitely postponed, meeting a December mainnet launch appears increasingly unlikely. The delay also threatens to squeeze preparations for Hegotá, the next major network upgrade slated to follow Glamsterdam.
Glamsterdam remains a critical milestone for Layer 1 scaling, promising to introduce features such as enshrined proposer-builder separation and block-level access lists. However, developers have made it clear that preserving smart contract security and mainnet backward compatibility takes priority over meeting arbitrary deadlines.
For node and validator operators currently running on the Hoodi testnet, action is required immediately:
As the Ethereum Foundation investigates the extent of contract exposure, a revised Hoodi testnet timeline will be announced in due course. Mainnet users and ETH holders do not need to take any direct action at this stage, as existing chain history and mainnet security remain completely unaffected.
Disclaimer: This article is provided for informational purposes only, mistakes may be made, and it's not offered or intended to be used as legal, tax, investment, financial, or any other advice.
