Ethereum delays Glamsterdam test after security devs flag risk to existing contracts

What it is

Ethereum developers cancelled the Glamsterdam activation on the Hoodi testnet, scheduled for 26 October 2026 at 17:42:48 UTC. They decided this at Thursday's All Core Devs Execution meeting. The trigger was ChainSecurity's 13 October 2026 analysis of how EIP-8037 and EIP-8038 change gas behaviour for contracts already deployed on mainnet. The planned Hoodi gas-limit increase to 200 million is also postponed. No new date exists for either, and mainnet has no confirmed Glamsterdam date.

How it works

EIP-8037 changes the charge for creating new database records, to limit state growth as throughput rises. ChainSecurity found that, combined with EIP-8038, it can change what a contract sees when a contract it calls runs out of gas. There are two directions.

• Gas restored after revert. Gas spent creating certain records is returned when those changes are undone. Some contracts catch a failed call and then record the failure, disable further attempts or move to another step. Developers have sometimes relied on too little gas remaining for that handler to finish, so the whole transaction reverts. Under the new rules the handler can finish, and the failure becomes permanent state.
• Higher cost in other cases. When a separate allowance is exhausted, creating a new storage slot could cost 110,020 gas, against 22,100 under current rules. A contract working to an existing gas budget could fail on an otherwise valid operation.

Preconditions / Affected

The first case needs a contract that handles a sub-call's out-of-gas failure and depends on the leftover gas being too small to complete the handler. The second needs a contract with a fixed or tight gas budget that creates storage slots. The page names no specific protocol.

What to do

The page gives no patch, command or detection. Its implication for contract authors is to check whether failure-handling paths or gas budgets assume the current gas accounting. That is an inference from the mechanism, not advice the page states.

Caveats

ChainSecurity demonstrated the mechanisms but has not publicly shown that any major production protocol is exploitable. The page says the findings do not indicate that existing contracts are being exploited. The rules are still proposals. Glamsterdam completed its Sepolia activation on 6 October 2026, before the issue was raised. The page does not say whether the EIPs will be changed or dropped.