Ethereum Delays Glamsterdam Hoodi Testnet Launch Over Gas Security Risks

Ethereum developers have postponed the Glamsterdam hard fork on the Hoodi testnet, moving it from its scheduled date of Oct. 26 after researchers identified gas-related security risks affecting existing smart contracts. The Ethereum Foundation confirmed the delay, saying it would give developers time to investigate how proposals inside the upgrade interact with contracts already deployed on Ethereum.

The trigger came on Oct. 13, when blockchain security firm ChainSecurity warned that two proposals included in Glamsterdam, EIP-8037 and EIP-8038, could weaken protections against a class of attacks known as insufficient gas griefing. That is the verified core of the story: a scheduled protocol change, a named security firm, and a measurable exposure — 13 real-world contracts confirmed as potentially affected, disclosed by ChainSecurity on Friday without naming the projects involved.

What do the gas changes actually do?

Under Glamsterdam's proposed rules, gas could be returned to a contract after an operation fails, allowing the contract to keep running in situations where it previously would have halted. ChainSecurity's analysis found that this behavior change can interfere with security checks that depend on how much gas remains available mid-transaction.

In an insufficient gas griefing attack, a malicious caller deliberately supplies too little gas for a legitimate smart contract operation to complete. ChainSecurity warned that Glamsterdam's changes could undermine safeguards built against exactly this scenario, potentially allowing contracts to permanently record failed operations.

The practical consequence is concrete. An affected contract could delete a user's claim or remove the option to retry it, leaving that user unable to complete an otherwise valid operation. In plain terms: a bug in the plumbing could turn a recoverable failure into a permanent loss of a user's entitlement.

ChainSecurity also stressed a limit on its own finding — Glamsterdam would not render every gas-related security check unreliable. Some safeguards could still function, but developers would need to review them individually to confirm they account for the upgrade's new gas rules. That review burden now sits with every project whose contracts depend on gas-remaining logic, and no one has published a list of which projects those are.

Who flagged it, and how strongly?

The concern was not confined to one firm. In an Oct. 21 comment on GitHub, pseudonymous security researcher pcaversaccio described the risks as "serious" and called for a full reassessment of the hard fork. That comment preceded the postponement decision by days.

On Friday, ChainSecurity said it had identified "13 real-world examples" of smart contracts potentially affected by the gas changes and was coordinating responsible disclosure with the affected projects. The firm did not disclose the identities of those projects or the details of the exposure. It did, however, advise developers to check their contracts as soon as possible — an implicit acknowledgment that the number could grow beyond 13 as more code is reviewed.

This is not the first warning attached to Glamsterdam. The Ethereum Foundation previously cautioned that the upgrade's gas model could break wallets, indexers, and gas estimation tools that rely on fixed assumptions about gas behavior. The upgrade was activated on the Sepolia testnet on Oct. 6, ahead of its now-postponed Hoodi deployment — meaning one testnet already runs code whose gas semantics are now under active security review.

What does the delay mean for the mainnet timeline?

The postponement introduces direct uncertainty into Glamsterdam's mainnet schedule. Ethereum developers had been considering early December for mainnet activation, with the plan to finalize that schedule only after successful testing on Hoodi. That sequence is now broken: Hoodi has no new date, and the December window depends on a testnet run that has not happened.

For teams building on Ethereum, the operational consequences are layered. Tooling vendors must audit gas estimation logic. Protocol teams must review whether their contracts treat gas-remaining checks as security boundaries. And every project in the responsible-disclosure queue must patch before mainnet activation — or run code whose failure handling may no longer behave as designed.

The takeaway in plain words: Ethereum has traded a calendar commitment for a security review, and 13 unnamed contracts are the reason. A revised Hoodi date, and with it a credible mainnet window, cannot be set until that review closes.