Ethereum postpones Glamsterdam testnet upgrade after 13 security risks

Gas-accounting proposals flagged as a threat to existing smart contracts, putting the end-of-2026 target in doubt

By LineZotpaper

Published23 October 2026

Read Time2 min

Ethereum developers have called off the scheduled Oct. 26 activation of the Glamsterdam upgrade on the Hoodi test network after a security review found vulnerabilities affecting existing smart contracts, casting doubt on the upgrade's end-of-2026 mainnet target.

Ethereum developers have postponed the Glamsterdam upgrade on the Hoodi test network after blockchain security firm ChainSecurity identified potential vulnerabilities in proposed changes to the network's gas-accounting system.

The Ethereum Foundation confirmed on Oct. 22 that the upgrade, scheduled to activate on Hoodi on Oct. 26, would no longer proceed as planned. Christine Kim, founder of research firm Protocol Watch, first disclosed the cancellation, urging affected Hoodi node operators to revert to older software versions or install updated execution clients that remove the scheduled activation.

The Foundation said the decision followed the Oct. 22 All Core Developers Execution meeting, where participants agreed to investigate how EIP-8037, a proposal to introduce a separate gas reserve for creating blockchain state, interacts with existing mainnet smart contracts. The postponement also suspends a planned increase in Hoodi's gas limit to 200 million, which was intended to test Ethereum's ability to handle substantially larger transaction volumes. The network's existing transaction history is unaffected.

The delay follows an Oct. 13 ChainSecurity report warning that EIP-8037 and a related proposal, EIP-8038, which changes the cost of accessing and modifying existing state, could undermine safeguards used by existing applications to distinguish failed transactions from operations that should remain eligible for another attempt. The firm said it had "already found 13 real-world examples" and was conducting responsible disclosure with affected projects, while urging developers to review their contracts immediately.

The affected applications include decentralized finance protocols handling withdrawals, batched transactions and other operations requiring automated failure recovery. Under the proposed gas rules, attackers could deliberately trigger insufficient-gas failures while allowing affected contracts to record the result as permanently unsuccessful, potentially preventing users from retrying otherwise valid operations.

The postponement narrows the window for completing Glamsterdam before the end of 2026. Developers had considered Dec. 1, Dec. 8 and Dec. 9 as possible mainnet activation dates, with a decision planned after Hoodi testing. The upgrade, which also introduces enshrined proposer-builder separation and block-level access lists, has already slipped from an original first-half 2026 target, and the delay could complicate preparations for Hegotá, the next major network overhaul.

Analysis

Why This Matters

Glamsterdam is Ethereum's major network upgrade of 2026 and has already slipped from its first-half target; the postponement threatens the year-end window.
The security findings touch the core of DeFi safety: the gas rules that determine when a failed transaction can be retried.
ChainSecurity says it found problems in 13 real-world deployed applications, not merely theoretical risks.

Background

Ethereum's roadmap runs upgrades through public test networks such as Hoodi before mainnet activation. Gas is the unit of computation and storage fees, and proposals EIP-8037 and EIP-8038 sought to align gas charges more closely with the resources smart contracts consume, increasing transaction capacity. This is the latest in a series of schedule slips: the Foundation targeted the first half of 2026 in February, and by September developers were working toward a December activation.

Key Perspectives

Ethereum developers and the Ethereum Foundation: The prudent path is to investigate how EIP-8037 interacts with existing contracts before testing proceeds, and the Foundation has said the decision came out of the core developers' execution call. ChainSecurity: The security firm says vulnerabilities already exist in deployed applications, has flagged 13 examples and is coordinating responsible disclosure, while urging developers to review their contracts immediately. DeFi application developers: Protocols that rely on automated failure recovery, including withdrawals and batched transactions, face uncertain behavior if the gas proposals ship unchanged, and may need to patch before the upgrade reaches mainnet.

What to Watch

The outcome of ChainSecurity's responsible disclosure and which affected projects act on its findings.
A newly confirmed mainnet activation date for Glamsterdam after the Dec. 1, Dec. 8 and Dec. 9 options were left unsettled.
Whether and when the 200 million gas limit test on Hoodi is rescheduled.

Sources

Ethereum’s long-awaited Glamsterdam upgrade hits another roadblock as 13 security risks emerge · CryptoSlate

Checked

12 claims in this story checked against 1 source: 11 supported.

Show each claim

SupportedEthereum postponed Glamsterdam after 13 security risks emerged.CryptoSlate: “Ethereum’s long-awaited Glamsterdam upgrade hits another roadblock as 13 security risks emerge.”
SupportedGas-accounting proposals were flagged as a threat to existing smart contracts.CryptoSlate: “ChainSecurity warned that the changes could undermine safeguards used by existing applications to distinguish failed transactions from operations that should remain eligible for another attempt.”
SupportedThe postponement puts the end-of-2026 mainnet target in doubt.CryptoSlate: “The setback threatens Ethereum's efforts to deliver Glamsterdam before the end of 2026”
SupportedThe scheduled Oct. 26 Hoodi activation was postponed.CryptoSlate: “The Ethereum Foundation confirmed on Oct. 22 that the upgrade, scheduled for Oct. 26 on the Hoodi testnet, would no longer proceed as planned.”
Partly supportedA security review found vulnerabilities affecting existing smart contracts.CryptoSlate: “Ethereum developers have postponed the Glamsterdam upgrade on a major test network after identifying potential security risks affecting existing smart contracts.”
SupportedChristine Kim, founder of Protocol Watch, first disclosed the cancellation and urged affected Hoodi node operators to revert or install updated execution clients.CryptoSlate: “Christine Kim, founder of research firm Protocol Watch, initially disclosed the cancellation, urging affected Hoodi node operators to revert to older software versions or install updated execution clients that remove the scheduled activation.”
SupportedAt the Oct. 22 All Core Developers Execution meeting, participants agreed to investigate EIP-8037 and its interaction with existing mainnet contracts.CryptoSlate: “The Foundation subsequently clarified that the decision followed discussions during the Oct. 22 All Core Developers Execution meeting, where participants agreed to conduct further investigations into EIP-8037 and its interactions with existing mainnet smart contracts.”
SupportedThe postponement suspends a planned Hoodi gas-limit increase to 200 million for testing greater transaction capacity.CryptoSlate: “The postponement also suspends the planned increase in Hoodi's gas limit to 200 million , which would have supported additional testing of Ethereum's ability to process substantially larger transaction volumes.”
SupportedChainSecurity said it had “already found 13 real-world examples”.CryptoSlate: “ChainSecurity said they “already found 13 real-world examples,” adding that it was conducting responsible disclosure with affected projects.”
SupportedAffected applications include DeFi protocols handling withdrawals, batched transactions and operations requiring automated failure recovery.CryptoSlate: “The findings affect decentralized finance applications that handle withdrawals, batched transactions, and other operations requiring automated failure recovery.”
SupportedAttackers could trigger insufficient-gas failures while affected contracts record the operation as permanently unsuccessful, potentially blocking valid retries.CryptoSlate: “This creates an opportunity for attackers to deliberately trigger insufficient-gas failures while allowing affected contracts to record the result, potentially preventing users from retrying otherwise valid operations.”
SupportedDevelopers had considered Dec. 1, Dec. 8 and Dec. 9 as possible mainnet activation dates, with a decision planned after Hoodi testing.CryptoSlate: “Before the latest postponement, the Oct. 22 core developers' meeting agenda identified Dec. 1, Dec. 8 and Dec. 9 as possible mainnet activation dates. Developers had planned to settle on a date the following week, following Hoodi testing.”