Ethereum Devs Postpone Glamsterdam on Hoodi Over Contract Security Risks

What it is

On 22 October 2026, Ethereum core developers postponed the Glamsterdam fork on the Hoodi testnet, four days before its 26 October activation. No new date is set. The page says the cause is not a client bug. Two gas-repricing proposals, EIP-8037 (state creation) and EIP-8038 (state access), could change how already-deployed contracts behave.

How it works

ChainSecurity published research on 13 October 2026 showing that these repricings can let a contract's failure path complete where it used to revert, with no code change. One example is a write to a fresh storage slot costing 110,020 gas instead of 22,100, which can exceed gas budgets hardcoded in older contracts.

The resulting app-layer risk is "insufficient gas griefing". A caller deliberately supplies too little gas, so a legitimate action is recorded as a permanent failure. That can block retries or wipe out claims. ChainSecurity said on X that it has found 13 real-world cases and is notifying the affected projects privately.

Affected

• Hoodi node and validator operators.
• Mainnet users and ETH holders: the page says they have nothing to do.
• Contract teams with older contracts that hardcode gas budgets or record failures permanently. The page does not publish the 13 affected projects.

What to do

Hoodi operators must update or roll back both their execution and consensus clients before Monday, 26 October 2026. Hoodi loses its planned Amsterdam (execution layer) and Gloas (consensus layer) activations, plus the planned gas-limit bump to 200M. The page names no client versions.

Caveats

• The Ethereum Foundation says developers need time to study how EIP-8037 interacts with mainnet contracts. The page does not say whether the EIPs will be changed.
• Nixo, quoted on the page, expects the delay "more than likely pushes glamsterdam on ethereum mainnet into 2027". Mainnet has no date.
• Any spec change would need new client releases, a new Hoodi date, and possibly a second fork on Sepolia, which already upgraded on 6 October 2026.
• Glamsterdam is headlined by enshrined proposer-builder separation (ePBS) and block-level access lists.
• The page gives no detection method or code-level mitigation for contract authors.