Ethereum’s Glamsterdam Test Hits the Brakes After Security Findings

Ethereum’s next major upgrade just hit the kind of speed bump that matters.

Developers have pulled the planned Glamsterdam activation from the Hoodi testnet after security researchers identified gas-accounting changes that could make existing smart contracts behave differently—even when their code has not changed.

That does not mean Ethereum is broken. It means the final public rehearsal for a major protocol change is no longer happening on the timetable developers had been working toward.

CryptoSlate reported that the October 26 Hoodi activation was halted after ChainSecurity identified 13 real-world examples affected by the proposed changes. The firm said it is working through responsible disclosure with the projects involved.

The planned Hoodi fork was the final major public test before mainnet, so the decision interrupts the upgrade’s critical path rather than merely shifting an internal developer milestone. The report also noted that the problem emerged after Glamsterdam had already activated on Sepolia, making Hoodi the next place to test the changes under conditions closer to mainnet.

The findings concern how new state-pricing rules interact with contracts that already depend on today’s gas behavior. Developers now need to determine whether the proposals can be adjusted without creating a new class of failures for deployed applications.

⚠️ It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified in this blog post: https://t.co/UCpy6Jp5Pa

We already found 13 real-world examples and are in responsible disclosure with the affected projects.
Please…

— ChainSecurity (@chain_security) October 22, 2026

The issue centers on EIP-8037 and EIP-8038, proposals that change how Ethereum charges gas for creating and accessing state. The practical concern is straightforward: a contract’s failure path could change under the new accounting rules.

In some cases, an operation that previously reverted could continue instead, potentially turning a recoverable problem into a permanent one.

Unchained detailed the immediate operational response. Ethereum Foundation DevOps engineer Barnabas Busa removed the scheduled fork from Hoodi’s shared configuration, while Besu developers merged a change to unschedule Amsterdam on Hoodi.

Node operators who had already installed a build containing the old activation setting still need an updated release or must revert to an earlier version.

The report also traced the rollback through Hoodi’s shared configuration: the Amsterdam timestamp, the Gloas epoch and the planned gas-limit increase were all removed. Those concrete changes matter because merging new code does not automatically protect nodes still running a release with the old fork schedule.

It further noted that no replacement Hoodi date accompanied the rollback. The upgrade therefore lost both its immediate test window and the milestone developers planned to use when choosing a mainnet date.

the reason for this is due to security issues found in #glamsterdam by @chain_security. More details on the security concerns about Glamsterdam here: https://t.co/5GgH0N6ZQu

— Christine D. Kim (@christine_dkim) October 22, 2026

The timeline matters because Hoodi was supposed to be Glamsterdam’s last major public test before mainnet. Developers had discussed December 1, December 8 and December 9 as possible mainnet dates, with the choice dependent on Hoodi going smoothly.

No replacement date was announced with the rollback. That makes an early-December mainnet activation less certain, although developers have not formally canceled a December launch.

The official Ethereum roadmap describes Glamsterdam as a structural scaling upgrade. Its centerpiece changes include enshrined proposer-builder separation, which moves important block-building mechanics into the protocol.

Glamsterdam also includes block-level access lists, which give nodes a clearer map of the state touched by transactions and prepare the network for more parallel processing.

The roadmap says the upgrade is designed to increase layer-one capacity while keeping node hardware requirements manageable. It also aims to price state creation more closely to the long-term storage burden placed on the network.

Those goals explain why the disputed gas changes matter to the larger package: Ethereum wants more room to scale without allowing database growth or contract behavior to become unpredictable.

Those are not cosmetic changes. Glamsterdam reaches into how Ethereum builds blocks, accounts for state and prepares for higher throughput.

A compatibility problem in that layer deserves a conservative response.

Crypto markets tend to reward speed right up until speed produces a preventable failure. Ethereum’s developers now have a real scheduling problem, but they also have something better than a clean calendar: specific examples found before the change reached mainnet.

The next things to watch are a technical resolution for the gas-accounting issue, fresh client releases that remove or revise the Hoodi activation, and a new testnet date. Only after that rehearsal succeeds will a mainnet date carry much weight.

For ETH holders, the near-term takeaway is not that Glamsterdam has failed. It is that the upgrade’s security review has moved from theory to concrete contract behavior—and developers chose to stop the clock instead of treating the deadline as sacred.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.