Ethereum’s long-awaited Glamsterdam upgrade hits another roadblock as 13 security risks emerge

The Ethereum Foundation confirmed on October 22 that the upgrade would no longer proceed as planned on the Hoodi testnet. Developers agreed to investigate how a proposed change to Ethereum's gas-accounting system could affect applications already operating on the blockchain.

Security Concerns

The postponement follows an October 13 report from blockchain security firm ChainSecurity, which identified potential vulnerabilities arising from two proposed changes to Ethereum's gas-accounting system. EIP-8037 introduces a separate gas reserve for creating blockchain state, while EIP-8038 changes the cost of accessing and modifying existing state.

ChainSecurity warned that these changes could undermine safeguards used by existing applications to distinguish failed transactions from operations that should remain eligible for another attempt. The firm disclosed they "already found 13 real-world examples" of problems in deployed applications.

Impact on Applications

The security warnings particularly affect decentralized finance applications that handle withdrawals, batched transactions, and other operations requiring automated failure recovery. Under Ethereum's existing rules, a failed operation can leave insufficient resources for failure-handling instructions, forcing transactions to revert.

Glamsterdam's proposed changes could alter that behavior by making some gas available again during execution. This could allow contracts that previously would have reverted to instead complete instructions, potentially preventing users from retrying valid operations.

Timeline Complications

The setback threatens Ethereum's efforts to deliver Glamsterdam before the end of 2026, after the upgrade was previously pushed beyond its original first-half target. Developers had considered several activation dates in early December but had not finalized a mainnet schedule.

The cancellation also suspends the planned increase in Hoodi's gas limit to 200 million, which would have supported additional testing of Ethereum's ability to process larger transaction volumes. Before the postponement, October 22 core developers' meeting had identified December 1, 8, and 9 as possible mainnet activation dates.

This disruption narrows the window for completing the upgrade before year-end and potentially complicates preparations for Hegotá, the next major network overhaul expected later in 2026.