Ethereum Delays Glamsterdam Upgrade on Hoodi Testnet Over Smart Contract Vulnerabilities

Ethereum core developers have canceled the scheduled activation of the Glamsterdam upgrade on the Hoodi testnet, which was previously slated for Oct. 26, 2026. The delay follows findings that the upgrade's changes to gas pricing would break invariants relied upon by some smart contracts, exposing them to vulnerabilities ¹.

Vulnerabilities Discovered by Chainsecurity

The delay stems from issues identified by Chainsecurity, which found that certain projects rely on invariants that are broken by EIP-8037 and EIP-8038 ¹. These EIPs rework how gas is charged for state creation and access operations ¹. Based on the discoveries, the All Core Developers (ACD) group decided to postpone the Hoodi hardfork until a resolution can be reached ¹. To facilitate a pragmatic decision, the Ethereum Foundation is engaging multiple auditing firms and conducting internal reviews ¹. A public repository detailing the eight broken invariants has been created to help contract developers verify if their projects are affected ¹.

Hoodi Configuration Reverted

The previously scheduled activation on Hoodi at epoch 132,352 is no longer planned, and a replacement date has not been set ². Core developers decided on ACDE #248 to delay the upgrade to allow for further investigation into how EIP-8037 interacts with mainnet smart contracts ². This delay removes both the Amsterdam execution layer activation and the Gloas consensus layer activation, as well as a gas-limit schedule that would have raised Hoodi's gas limit to 200M ². Node and validator operators are advised to update their clients to software versions that reflect the postponed activation ².

Glamsterdam Upgrade Details

Glamsterdam is a major upgrade that combines the Amsterdam execution layer and the Gloas consensus layer ³. Its primary features are enshrined proposer-builder separation (ePBS) under EIP-7732 and block-level access lists (BALs) under EIP-7928 ³. ePBS aims to reduce reliance on trusted middleware by bringing the separation of block proposers and builders into the consensus protocol ³. BALs are designed to allow clients to parallelize state reading and transaction validation, improving efficiency ³.

In addition to these changes, the upgrade includes significant adjustments to gas accounting. EIP-8037 increases the cost of creating state, while EIP-8038 updates the cost of state access ³. Other changes cover intrinsic transaction gas, calldata, and block gas accounting ³. Application developers have been advised to test their contracts against these new rules, especially those relying on fixed gas stipends or assumptions about remaining gas ³.

Client Software Updates

Several client teams have released updates to unschedule the Hoodi fork. For example, Besu released version 26.10.1, which reverts the scheduling of Amsterdam on Hoodi ⁶. The eth-clients/hoodi repository removed amsterdamTime from Hoodi's genesis file, moving the GLOAS_FORK_EPOCH to infinity ⁷. Lodestar and ethrex also merged pull requests to align with the unscheduled activation ⁷. Developers using external block-building infrastructure must follow instructions from their tooling providers ².