Ethereum developers have officially decided to postpone the deployment of the upcoming Glamsterdam hard fork on the Hoodi testnet. The decision comes in the wake of critical security warnings issued by blockchain researchers, who identified significant gas-related vulnerabilities that could drastically alter how existing smart contracts handle failed transactions on the network.
According to an official announcement from the Ethereum Foundation (EF), the network upgrade—which was originally scheduled to go live on the Hoodi testnet on October 26—is being pushed back indefinitely. The delay has been implemented to grant core developers, client teams, and researchers sufficient time to thoroughly investigate how specific improvement proposals included in the upgrade interact with complex smart contracts already deployed and running in production on the Ethereum blockchain.
The postponement introduces a layer of uncertainty regarding the broader mainnet rollout timeline for Glamsterdam. Prior to the discovery of these vulnerabilities, Ethereum developers had been actively discussing an early December target for the mainnet release, with the final schedule heavily dependent on the smooth execution and observation of successful testing phases across public testnets like Hoodi.
Gas Changes Could Undermine Existing Smart Contract Safeguards
The root of the delay traces back to an alarming security analysis published on October 13 by blockchain security firm ChainSecurity. In their technical evaluation, researchers warned that two specific improvement proposals bundled into the Glamsterdam upgrade—namely EIP-8037 and EIP-8038—could fundamentally alter transaction execution mechanics in a way that weakens established safeguards against a known vector called insufficient gas griefing.
Under the newly proposed rules analyzed by ChainSecurity, gas can potentially be returned to a contract after an operation fails. Under current Ethereum rules, a failed transaction or sub-operation under certain conditions would halt execution immediately; however, the proposed modifications could allow a contract to continue running past the point where it previously would have stopped. The researchers explained that these unexpected shifts could directly interfere with existing security logic and conditional checks implemented by developers, which heavily rely on precise tracking of how much gas remains available during the lifecycle of a transaction.
Insufficient gas griefing represents a subtle yet dangerous attack vector in decentralized finance and smart contract architecture. In these scenarios, a malicious caller deliberately provides just enough—or crucially, too little—gas for a legitimate smart contract operation to succeed, while attempting to manipulate the resulting state. ChainSecurity warned that Glamsterdam’s proposed modifications could undermine foundational safeguards designed to protect against such exploits. This disruption could potentially allow contracts to permanently record failed operations as valid or mishandled states.
To illustrate the severity of the issue, an affected smart contract could inadvertently remove a legitimate user’s pending claim or permanently disable the user interface option to retry a failed transaction. This would leave the user entirely unable to complete an otherwise valid and intended financial operation or protocol interaction.
Despite the gravity of the findings, ChainSecurity clarified that the Glamsterdam upgrade would not render all gas-related security checks completely unreliable. Certain defensive mechanisms would continue to function as intended, but developers across the ecosystem would still need to conduct rigorous code reviews to ensure their existing safety assumptions account for the new gas rules introduced by the upgrade.
The security findings quickly generated widespread concern among core contributors and independent auditors participating in Ethereum’s development lifecycle. On October 21, prominent pseudonymous security researcher pcaversaccio took to GitHub to weigh in on the situation, describing the underlying risks as "serious" and formally calling for a comprehensive reassessment and restructuring of the hard fork parameters.
Adding to the urgency, ChainSecurity revealed on Friday that its ongoing investigations had successfully uncovered "13 real-world examples" of vulnerable contracts in the wild. The security firm noted that it was actively coordinating responsible disclosure efforts with the various projects affected by these discoveries. While ChainSecurity opted not to publicly disclose specific technical details regarding the 13 real-world examples, nor identify the individual projects impacted, the firm strongly urged all smart contract developers across the Ethereum ecosystem to audit their codebases and check their deployed contracts for potential gas dependency issues as soon as possible.
These latest security revelations compound an already complex testing phase for the Glamsterdam upgrade. Earlier, the Ethereum Foundation issued a separate advisory warning developers and infrastructure providers that the sweeping changes introduced by Glamsterdam’s new gas model could potentially break common ecosystem tools, including certain wallets, blockchain indexers, and gas estimation utilities that rely on legacy fixed assumptions about EVM behavior.
Prior to the Hoodi testnet delay, the Glamsterdam upgrade had already achieved initial public testnet activation when it went live on the Sepolia testnet on October 6. However, the unexpected discovery of gas-related transaction vulnerabilities has forced the development community to pump the brakes, prioritizing network stability and smart contract security over pre-determined launch deadlines.
