Ethereum’s long-awaited Glamsterdam upgrade hits another roadblock as 13 security risks emerge
Ethereum developers have postponed the Glamsterdam upgrade on a major test network after identifying potential security risks affecting existing smart contracts.
The Ethereum Foundation confirmed on Oct. 22 that the upgrade, scheduled for Oct. 26 on the Hoodi testnet, would no longer proceed as planned. Developers agreed to investigate how a proposed change to Ethereum’s gas-accounting system could affect applications already operating on the blockchain.
The setback threatens Ethereum’s efforts to deliver Glamsterdam before the end of 2026, after the upgrade was previously pushed beyond its original first-half target. Developers had considered several activation dates in early December, but had not finalized a mainnet schedule.
Christine Kim, founder of research firm Protocol Watch, initially disclosed the cancellation, urging affected Hoodi node operators to revert to older software versions or install updated execution clients that remove the scheduled activation.
The Foundation subsequently clarified that the decision followed discussions during the Oct. 22 All Core Developers Execution meeting, where participants agreed to conduct further investigations into EIP-8037 and its interactions with existing mainnet smart contracts.
The postponement also suspends the planned increase in Hoodi’s gas limit to 200 million, which would have supported additional testing of Ethereum’s ability to process substantially larger transaction volumes. The network’s existing transaction history remains unaffected.
Security warnings affect Ethereum’s December upgrade target
The postponement follows an Oct. 13 report from blockchain security firm ChainSecurity, which identified potential vulnerabilities arising from two proposed changes to Ethereum’s gas-accounting system.
EIP-8037 introduces a separate gas reserve for creating blockchain state, while EIP-8038 changes the cost of accessing and modifying existing state. Both proposals aim to increase transaction capacity by aligning gas charges more closely with the resources smart contracts consume.
However, ChainSecurity warned that the changes could undermine safeguards used by existing applications to distinguish failed transactions from operations that should remain eligible for another attempt.
The firm subsequently disclosed that its investigation had already uncovered problems in deployed applications.
ChainSecurity said they “already found 13 real-world examples,” adding that it was conducting responsible disclosure with affected projects.
The security firm urged developers to review their contracts immediately as the Ethereum Foundation investigates how many applications the proposed changes expose and what the potential consequences are.
The findings affect decentralized finance applications that handle withdrawals, batched transactions, and other operations requiring automated failure recovery.
Under Ethereum’s existing execution rules, a failed operation that consumes its allocated gas can leave insufficient resources for the calling contract to complete its failure-handling instructions, forcing the broader transaction to revert.
Glamsterdam’s proposed changes could alter that behavior by making some gas available again during execution. Consequently, contracts that previously would have reverted could instead complete instructions, recording an operation as permanently unsuccessful.
This creates an opportunity for attackers to deliberately trigger insufficient-gas failures while allowing affected contracts to record the result, potentially preventing users from retrying otherwise valid operations.
The discovery has intensified scrutiny of Glamsterdam’s compatibility with existing applications, adding another obstacle to an upgrade that has already missed its original deployment window.
In February, the Ethereum Foundation targeted the first half of 2026 for Glamsterdam, with another major network upgrade, Hegotá, expected later in the year.
That schedule subsequently slipped, and by September, developers were working toward a December activation for Glamsterdam.
The upgrade is expected to introduce enshrined proposer-builder separation and block-level access lists, changes intended to improve transaction processing and support greater network capacity without imposing disproportionate demands on node operators.
Before the latest postponement, the Oct. 22 core developers’ meeting agenda identified Dec. 1, Dec. 8 and Dec. 9 as possible mainnet activation dates. Developers had planned to settle on a date the following week, following Hoodi testing.
The cancellation disrupts that sequence, narrowing the window for completing the upgrade before year-end and potentially complicating preparations for Hegotá, the next major network overhaul.
