Ethereum Delays Glamsterdam Testnet Fork Over Gas Security Flaws

What it is

Ethereum developers postponed the Glamsterdam hard fork on the Hoodi testnet, which was due on Monday 26 October 2026. ChainSecurity announced the delay on 22 October 2026, after finding security impacts in the upgrade's gas changes. No new Hoodi date has been set.

How it works

Glamsterdam changes how Ethereum charges for creating and accessing stored data (EIP-8037 and EIP-8038) and adds a separate gas pool for creating new state. ChainSecurity says these changes break assumptions contracts make when an external call fails.

Some contracts use gas checks, or rely on a call running out of gas, to defeat insufficient gas griefing. In that attack, someone supplies too little gas so a valid operation fails and is recorded as a permanent failure. Under Glamsterdam, gas can be refilled or returned to a contract after a failed call, and repricing can change how much gas a call needs. ChainSecurity wrote: "Even with unchanged contract code, a failure path that previously reverted can now complete." Contracts built to keep a failed operation retryable could therefore record it permanently.

Preconditions / Affected

Affected contracts are those that guard against insufficient gas griefing with gas checks or out-of-gas behaviour. ChainSecurity has found 13 real-world examples and is in responsible disclosure with those projects. The Ethereum Foundation is still assessing how many contracts are exposed.

What to do

Hoodi node operators have two options, according to researcher Christine Kim:

• Revert to an older software release that does not schedule the upgrade.
• Wait for the execution client team to release a version that cancels it.

Preston Van Loon, a Prysm consensus client developer, said a Prysm release removing the upgrade from Hoodi's schedule would follow the same day.

Contract authors should review any failure-path logic that depends on gas checks or out-of-gas behaviour. ChainSecurity urged projects to check their contracts.

Caveats

The page does not name the 13 affected projects or give the full technical analysis, which sits in ChainSecurity's blog post. It gives no estimate of total exposure.

Glamsterdam is already live on the Sepolia testnet, where it activated on 6 October 2026. Developers had aimed for mainnet by the end of 2026, ahead of the Hegotá upgrade expected in 2027. The page does not say whether the delay moves the mainnet target.