Ethereum’s Glamsterdam delay puts Hoodi testnet upgrade on hold over gas risks

What it is

ChainSecurity, a security firm, found that two Glamsterdam gas proposals, EIP-8037 and EIP-8038, can defeat defenses that contracts use against insufficient gas griefing. Ethereum developers then postponed the Glamsterdam activation on the Hoodi testnet, which was scheduled for 26 October 2026. ChainSecurity first warned of the risk on 13 October 2026 and found 13 real-world contracts that could be affected.

How it works

In insufficient gas griefing, an attacker supplies too little gas so a valid external call fails, and the caller records that failure as permanent. Some contracts defend against this by checking available gas, or by relying on a call exhausting its gas.

EIP-8037 and EIP-8038 change charges for creating and accessing stored data and add a separate gas pool for creating new state. Under Glamsterdam, gas can be replenished or returned after a failed call, and repricing changes how much gas a call needs. Both effects can break the assumptions behind those defenses. ChainSecurity wrote: "Even with unchanged contract code, a failure path that previously reverted can now complete."

Preconditions / Affected

• Contracts that check available gas, or depend on a call running out of gas, to keep a failed external call retryable.
• Hoodi node operators, who have the fork scheduled in their client software.
• Glamsterdam is already live on Sepolia (since 6 October 2026, gas limit near 200 million). The page does not say whether Sepolia contracts are affected.
• The Ethereum Foundation is still assessing how many contracts are exposed. The page does not name the 13 contracts.

What to do

• Hoodi node operators: Christine Kim advised either returning to an older release that does not schedule the upgrade, or waiting for the execution client team to ship a version that cancels it. Preston Van Loon, a Prysm developer, said a Prysm release removing Glamsterdam from Hoodi's schedule would come on 24 October 2026. The page gives no version numbers.
• Contract teams: review contracts that handle failed external calls, as ChainSecurity urged. ChainSecurity is contacting affected projects through responsible disclosure.

Caveats

The page gives no remedy for affected contracts and no new mainnet date. Before the delay, developers had targeted mainnet by the end of 2026, had considered early December, and planned to set the schedule after successful Hoodi testing.