Ethereum Foundation delays Glamsterdam upgrade after security risks found

Ethereum’s Glamsterdam upgrade faces fresh delays after security researchers identified 13 real-world smart contracts vulnerable to the proposed changes. With mainnet activation slipping further into December at best, the upgrade’s year-end deadline is now at risk.

• Ethereum Foundation postponed the Glamsterdam upgrade on Hoodi testnet scheduled for October 26 after identifying security risks.
• ChainSecurity identified 13 real-world vulnerable smart contracts affected by proposed gas-accounting changes EIP-8037 and EIP-8038.
• The delay narrows the window for Glamsterdam before year-end and threatens the timeline for the subsequent Hegotá upgrade.

• 13 Real-world smart contract vulnerabilities discovered by ChainSecurity in deployed applications
• 200M Hoodi testnet gas limit increase now suspended pending further investigation
• Dec 1-9 Possible mainnet activation dates previously considered by core developers
• 2H 2026 Original deployment target set in February before schedule slipped

The Ethereum Foundation confirmed on October 22 (Thursday) that it would delay the Glamsterdam upgrade on the Hoodi testnet, originally scheduled to activate on October 26 (Monday), according to CryptoSlate. The decision came after developers identified potential security vulnerabilities in how the upgrade’s proposed changes to Ethereum’s gas-accounting system would interact with existing smart contracts already operating on the blockchain. Christine Kim, founder of Protocol Watch, initially disclosed the cancellation, urging Hoodi node operators to revert to older software or install updated execution clients that remove the scheduled activation.

ChainSecurity warns of 13 vulnerable contracts in the wild

Blockchain security firm ChainSecurity reported that it had already discovered 13 real-world examples of deployed smart contracts vulnerable to the proposed changes. The firm identified risks arising from two separate Ethereum Improvement Proposals: EIP-8037, which introduces a separate gas reserve for creating blockchain state, and EIP-8038, which changes the cost of accessing and modifying existing state. Both proposals aim to increase Ethereum’s transaction capacity by aligning gas charges more precisely with the computational resources smart contracts actually consume.

The vulnerability centers on how existing smart contracts use gas to manage failure recovery. Under current Ethereum rules, when a failed operation consumes all its allocated gas, insufficient resources remain for the calling contract to execute failure-handling instructions, forcing the entire transaction to revert. ChainSecurity warned that Glamsterdam’s proposed changes could alter this behavior by making some gas available again during execution, allowing contracts that previously would have reverted to instead complete instructions and record an operation as permanently unsuccessful. This creates an attack surface: malicious actors could deliberately trigger insufficient-gas failures while affected contracts record the result, potentially preventing users from retrying otherwise valid operations.

The discovery primarily affects decentralized finance applications that handle withdrawals, batched transactions, and other operations requiring automated failure recovery.

Postponement suspends Hoodi testing and slips mainnet schedule

The postponement also suspends the planned increase in Hoodi’s gas limit to 200 million, which would have enabled developers to test Ethereum’s ability to process substantially larger transaction volumes. Ethereum’s existing transaction history on Hoodi remains unaffected by the decision. The Ethereum Foundation clarified that the decision followed discussions during the October 22 All Core Developers Execution meeting, where participants agreed to conduct further investigations into EIP-8037 and EIP-8038 and their interactions with existing mainnet smart contracts.

Before the postponement, the core developers’ meeting agenda had identified December 1, December 8, and December 9 as possible mainnet activation dates, with developers planning to settle on a final date the following week after Hoodi testing concluded. The cancellation disrupts that sequence, threatening Ethereum’s efforts to deliver Glamsterdam before the end of 2026. The delay also threatens the timeline for Hegotá, the next major network upgrade, which had been expected later in the year.

Glamsterdam now months behind its original February target

Glamsterdam’s deployment window has contracted significantly since the Ethereum Foundation targeted the first half of 2026 for activation in February. That schedule slipped over subsequent months, and by September, developers had pivoted to a December activation date. The upgrade is expected to introduce enshrined proposer-builder separation and block-level access lists, changes intended to improve transaction processing and support greater network capacity without imposing disproportionate demands on node operators.

Already found 13 real-world examples.

ChainSecurity, in a post on their investigation

ChainSecurity urged developers to review their contracts immediately as the Ethereum Foundation investigates how many applications the proposed changes expose and what the potential consequences are. The security firm conducted responsible disclosure with affected projects rather than publishing findings publicly without warning.

The BlockWest read. The delay reflects a structural tension in Ethereum’s upgrade process: ambitious changes to core economics require exhaustive compatibility testing, but that testing consumes time within an already constrained calendar. Glamsterdam’s February-to-December slip shows how late-stage security findings can compress the runway for larger development roadmaps. Allocators watching Ethereum’s scaling promises should expect further timeline erosion as the Foundation’s investigation widens.

The Ethereum Foundation and core developer community must now determine whether to accelerate the security review to salvage a December activation, accept a 2027 deployment, or revise the scope of EIP-8037 and EIP-8038 to eliminate the identified vulnerabilities. The core developers’ issue tracker will likely document the next phase of investigation and any revised activation dates as the community responds to ChainSecurity’s findings.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.