Ethereum developers have pulled the Glamsterdam upgrade from its planned launch on the Hoodi test network, after security auditor ChainSecurity found that its gas changes could leave some smart contracts open to attack.
The fork had been due to activate on Hoodi on Monday. No new date had been set at the time of writing.
“It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified,” ChainSecurity said.
What the flaw is
Glamsterdam changes how gas, the fee for running operations on Ethereum, is charged for creating and accessing stored data. Those changes come through two proposals, EIP-8037 and EIP-8038. The upgrade also adds a separate gas pool for creating new state.
ChainSecurity says the changes break assumptions that many contracts rely on when an external call fails.
That could expose contracts that use gas checks to what is known as insufficient gas griefing. In that attack, someone supplies too little gas so that a valid operation is permanently recorded as failed.
“Even with unchanged contract code, a failure path that previously reverted can now complete,” ChainSecurity said.
How many contracts are exposed
ChainSecurity says it has found 13 real-world examples so far and is working privately with the affected projects. The Ethereum Foundation is assessing how many contracts could be affected in total.
What node operators need to do
Ethereum researcher Christine Kim advised node operators running Hoodi to switch back to an older software release without the upgrade scheduled, or to wait for a new client release that cancels it.
Prysm developer Preston Van Loon said a Prysm release removing the upgrade from Hoodi’s schedule would follow the same day.
What Glamsterdam is meant to do
Glamsterdam is already live on the Sepolia test network, where it activated on 6 October with a gas limit of almost 200 million, more than three times mainnet’s 60 million.
The upgrade adds block-level access lists, which let transactions be checked in parallel, and moves the rules for auctioning block building into the protocol itself.
What happens next
Developers had aimed to ship Glamsterdam on mainnet by the end of 2026. Whether this delay pushes that back had not been confirmed at the time of writing.
The issue was caught on a test network, before any change reached mainnet or put user funds at risk.
