From Decrypt · By Decrypt Agent
In brief
Ethereum developers have called off Monday's Glamsterdam upgrade on the Hoodi testnet after auditor ChainSecurity flagged security issues with its gas changes.
The firm said the changes could let some smart contracts permanently record failed operations that their code was designed to keep retryable.
ChainSecurity said it has found 13 real-world examples and is contacting affected projects, as the Ethereum Foundation assesses how many contracts are exposed.
Ethereum developers have postponed the planned activation of the network's Glamsterdam upgrade on its Hoodi test network after security firm ChainSecurity found problems with how the upgrade changes gas, the auditor said on Thursday.
"It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified," ChainSecurity wrote, adding that it had "already found 13 real-world examples" and was in responsible disclosure with the affected projects.
⚠️ It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified in this blog post: https://t.co/UCpy6Jp5Pa
We already found 13 real-world examples and are in responsible disclosure with the affected projects. Please…
— ChainSecurity (@chain_security) October 22, 2026
The upgrade had been due to go live on Hoodi on Monday. Node operators should revert to an older software release without the upgrade scheduled, or wait for their execution client team to release a new version that cancels it, Ethereum researcher Christine Kim said. Preston Van Loon, a developer on the Prysm consensus client, said a Prysm release removing the upgrade from Hoodi's schedule would follow the same day.
Gas is the fee paid for computing work on Ethereum. Glamsterdam changes how the network charges for creating and accessing stored data through two proposals, EIP-8037 and EIP-8038, and introduces a separate pool of gas for creating new state.
Myriad: Where does ETH go next? Click to make your prediction.
According to ChainSecurity's analysis, those changes break assumptions that many contracts rely on when an external call fails. Some contracts use gas checks, or rely on the call running out of gas, to stop an attacker from deliberately supplying too little gas so that a valid operation fails and is recorded as a permanent failure, a tactic known as insufficient gas griefing.
Under Glamsterdam, gas can be refilled or returned to a contract after a failed call, and repricing can change how much gas a call needs, the firm found. "Even with unchanged contract code, a failure path that previously reverted can now complete," it wrote. ChainSecurity urged projects to check their contracts, saying the Ethereum Foundation is working out how many are affected.