Ethereum Delays Glamsterdam Testnet Fork Over Gas Security Flaws

The planned activation of the Glamsterdam upgrade on Ethereum's Hoodi test network has been called off after security firm ChainSecurity discovered critical issues with how the network changes gas fees. The upgrade had been scheduled for Monday but was postponed after auditors identified problems that could allow some smart contracts to permanently record failed operations that were designed to be retryable.

Gas Security Flaws

Gas is the fee paid for computing work on Ethereum. The Glamsterdam upgrade, which includes proposals EIP-8037 and EIP-8038, changes how the network charges for creating and accessing stored data. ChainSecurity found these changes break assumptions that many contracts rely on when external calls fail.

Some contracts use gas checks to prevent attackers from deliberately supplying insufficient gas, causing valid operations to fail permanently—a tactic known as insufficient gas griefing. Under Glamsterdam, gas can be refilled after a failed call, potentially changing how much gas a call needs.

The firm warned that even with unchanged contract code, failure paths that previously reverted could now complete. ChainSecurity is working with affected projects while the Ethereum Foundation assesses how many contracts are exposed to these vulnerabilities.

Upgrade Status

Glamsterdam has already been successfully implemented on the Sepolia test network, where it activated on October 6 and began producing blocks with a gas limit of nearly 200 million—more than three times Ethereum mainnet's 60 million limit. The upgrade also introduces block-level access lists for parallel transaction processing.

Node operators on Hoodi have been instructed to revert to older software releases without the upgrade or wait for their execution client teams to release versions that cancel it. A Prysm release removing the upgrade from Hoodi's schedule is expected the same day.

Developers had aimed to deploy Glamsterdam on Ethereum's mainnet by the end of 2026, ahead of the Hegotá upgrade expected in 2027 which could add native privacy features. No new date has been set for the Hoodi fork as the security issues are addressed.