Newsletter
After Ethereum developers were alerted by the auditing firm ChainSecurity that changes to Gas posed security issues, they have canceled the Glamsterdam upgrade that was scheduled to be tested on the test network at Hoodi on Monday.
The institution stated that these changes could result in certain smart contracts permanently recording operations that were originally designed to be retryable but failed.
ChainSecurity says that it has identified 13 real cases and is in contact with the affected projects; at the same time, the Ethereum Foundation is also assessing how many contracts will be impacted.
As of Thursday, it was reported that after discovering issues with the Gas mechanism affected by this upgrade, Ethereum developers have postponed the plan to activate the Glamsterdam upgrade on the test network, which was originally scheduled for Hoodi.
"We have just decided to postpone the Glamsterdam hard fork on the Hoodi test network because we have identified security concerns," ChainSecurity wrote, adding that "13 real cases have been discovered" and that they are currently conducting responsible disclosure with the affected projects.
⚠️ We have just decided to postpone the Glamsterdam hard fork on the Hoodi test network, as we have identified security vulnerabilities in this blog post: https :// t.co / UCpy6Jp5Pa. We have discovered 13 real cases and are conducting responsible disclosure with the affected projects. Please... — ChainSecurity (@chain_security) October 22, 2026
The upgrade was originally scheduled to go live on Monday at Hoodi. Ethereum researcher Christine Kim suggested that node operators should revert to the older version of the software that did not include this upgrade, or wait for the client team to release a new version that cancels this upgrade. Prysm, a developer for the Prysm consensus client, stated that a version that removes this upgrade from the Hoodi schedule would also be released on that day.
Gas is the fee paid on Ethereum for computing work. Glamsterdam changed the way the network charges for creating and accessing stored data through two proposals, EIP-8037 and EIP-8038, and introduced an independent Gas pool for creating new states.
According to the analysis of ChainSecurity, these changes have disrupted the assumptions on which many contracts rely when external calls fail. Some contracts use Gas for checks, or depend on the consumption of Gas to prevent attackers from deliberately providing too little Gas, which could lead to a valid operation failing and being recorded as a permanent failure; this tactic is known as the "insufficient Gas harassment attack" ( insufficient gas griefing ).
ChainSecurity has found that under Glamsterdam, Gas may be replenished or returned to the contract after a failed call, and the re-pricing may also change the amount of Gas required for a single call. The institution wrote: 'Even if there is no change in the contract code, the previously failed paths that would have been rolled back may now be completed.' ChainSecurity urges projects to check their own contracts and indicates that the Ethereum Foundation is working out how many projects are affected.
Glamsterdam Moving towards the mainnet
Glamsterdam has been launched on Sepolia, which is another testing network for Ethereum. On October 6th, that upgrade was activated, and the generation of blocks on Gas began. The upper limit for blocks on this network is nearly 200 million, more than three times the 60 million limit of the mainnet. This upgrade also added a block-level access list, allowing computers to check transactions in parallel, and incorporated an auction mechanism to determine who will assemble each block into Ethereum's own rules.
Developers originally planned to launch Glamsterdam onto the mainnet by the end of 2026, which is earlier than Hegot. Hegot is the next upgrade, expected to be launched in 2027, and may include native privacy features. No new date has yet been set for the Hoodi fork.
