SMS
Ethereum developers have canceled the planned Glamsterdam upgrade on the Holesky testnet for Monday after ChainSecurity, an audit firm, alerted them to security issues with the gas changes.
The institution stated that these changes could cause certain smart contracts to permanently record failure operations that were originally designed to be retryable.
ChainSecurity said it has identified 13 real cases and is reaching out to the affected projects; meanwhile, the Ethereum Foundation is assessing how many contracts are impacted.
ChainSecurity said on Thursday that Ethereum developers have postponed the planned activation of the Glamsterdam upgrade on the Holesky testnet after identifying issues with the upgrade's changes to the Gas mechanism.
“We have just decided to postpone the Glamsterdam hard fork on the Hoodi testnet due to identified security implications,” ChainSecurity wrote, adding that it “has discovered 13 real-world cases” and is currently engaging in responsible disclosure with the affected projects.
⚠️ We have just decided to postpone the Glamsterdam hard fork on the Hoodi testnet after identifying security implications in this blog post: https://t.co/UCpy6Jp5Pa We have found 13 real-world cases and are conducting responsible disclosures with affected projects. Please... — ChainSecurity (@chain_security) October 22, 2026
The upgrade was originally scheduled to go live on Hoodi on Monday. Ethereum researcher Christine Kim said that node operators should revert to an older version of the software that does not include the upgrade, or wait for their execution client team to release a new version that cancels the upgrade. Prysm consensus client developer Preston Van Loon said that Prysm would also release a version on the same day that removes the upgrade from Hoodi’s schedule.
Gas is the fee paid for computational work on Ethereum. Glamsterdam changes the way the network charges for creating and accessing stored data through two proposals, EIP-8037 and EIP-8038, and introduces a separate gas pool for creating new state.
According to ChainSecurity’s analysis, these changes break assumptions that many contracts rely on when external calls fail. Some contracts use gas checks or depend on calls exhausting gas to prevent attackers from deliberately providing insufficient gas, causing a valid operation to fail and be recorded as permanently failed; this technique is known as “insufficient gas griefing.”
ChainSecurity found that under Glamsterdam, gas may be replenished or refunded to the contract after a failed call, and repricing could also alter the amount of gas required for a call. The firm wrote: “Even if the contract code remains unchanged, previously reverting failure paths may now complete.” ChainSecurity urged projects to review their own contracts, noting that the Ethereum Foundation is assessing how many projects are affected.
Glamsterdam moves to mainnet
Glamsterdam has gone live on Sepolia, another Ethereum test network, which activated the upgrade on October 6 and began producing blocks with a gas limit approaching 200 million—more than three times the mainnet’s limit of 60 million. The upgrade also introduced block-level access lists, enabling computers to verify transactions in parallel, and incorporated the auction mechanism that determines who assembles each block directly into Ethereum’s core rules.
The developers originally planned to launch Glamsterdam on mainnet by the end of 2026, ahead of Hegotá. Hegotá, the next upgrade, is expected to launch in 2027 and may introduce native privacy features. No new date has been set for the Hoodi fork.