Ethereum developers have indefinitely delayed the Glamsterdam upgrade on the Hoodi testnet after security concerns emerged over how proposed gas changes could affect existing smart contracts. In a blog post published on Oct. 22, the Ethereum Foundation said the fork previously scheduled for Oct. 26 at 17:42 UTC, on epoch 132,352, had been canceled. No new activation date was provided.
The decision came during the All Core Devs Execution (ACDE) #248 meeting held the same day. Rather than proceed on schedule, core developers opted to investigate how EIP-8037 interacts with smart contracts already deployed on mainnet.
Multiple Hoodi changes were pulled at the same time
The cancellation also covered the Amsterdam execution-layer activation, the Gloas consensus-layer activation, and the plan to raise Hoodi’s gas limit to 200 million.
The Ethereum Foundation said this rollback only removes configuration for a future upgrade and does not erase Hoodi’s existing on-chain history. The Oct. 26 activation was removed from the configuration outright, with no replacement epoch or timestamp announced.
Node operators and validators on Hoodi were told to review both execution-layer and consensus-layer clients. Any software still using the old schedule, along with any custom network settings tied to it, needs to be updated.
Why the gas changes raised contract security concerns
The core issue is what happens to gas after a failed call. In an analysis published on Oct. 13, blockchain security firm ChainSecurity examined the combined effect of EIP-8037 and EIP-8038.
EIP-8037 changes state creation accounting and introduces a separate state-gas reservoir. EIP-8038 reprices state access. Under the proposed rules, ChainSecurity said, gas from a failed call may flow back to the calling contract. That can allow failure-handling logic, which would previously have stopped because of insufficient gas, to continue running. In some cases, a failure that should have remained retryable could be written into state as a permanent, irreversible failure.
ChainSecurity described the pattern as insufficient gas griefing
ChainSecurity said the attack works when a malicious caller deliberately supplies too little gas for an otherwise valid operation. The operation fails, but enough gas remains for the contract to record that failure in state.
Affected contracts could then remove a user’s claim eligibility or disable the retry path, leaving an operation that should have succeeded eventually in a permanently incomplete state.
The firm also said not every gas-related security check breaks under the new model. Some protections still hold. Even so, developers need to review contracts one by one to determine whether they rely on older gas assumptions.
Thirteen real-world contracts have already been identified
The findings quickly triggered discussion inside the Ethereum community. Security researcher pcaversaccio wrote in the GitHub discussion thread for ACDE #248 on Oct. 21 that the risk was "serious" and called for the hard fork to be reassessed.
On Oct. 23, ChainSecurity said on X that it had found "13 real-world examples" and was carrying out responsible disclosure with the affected projects. It did not publish details, but it urged developers to check their contracts as soon as possible.
The Ethereum Foundation is also investigating how many contracts may be affected and what forms that impact could take.
Not the first warning sign for Glamsterdam
The Ethereum Foundation had already warned that Glamsterdam’s gas model could break assumptions used by wallets, indexers, and gas estimation tools. Glamsterdam itself had already gone live on the Sepolia testnet on Oct. 6.
The Hoodi halt effectively stops the staged testnet rollout at its second step.
Mainnet timing is now up in the air
According to the ACDE #248 agenda, Dec. 1, Dec. 8, and Dec. 9 had been listed as candidate dates for the Glamsterdam mainnet upgrade. The plan was to finalize one of them at next week’s ACDC meeting after a successful Hoodi test.
With Hoodi now delayed indefinitely, that anchor is gone. The mainnet schedule now depends entirely on the outcome of the EIP-8037 contract impact review.
For applications and tools across the ecosystem, that means more uncertainty for anything built around Glamsterdam’s new gas model.
What the market and developers are watching next
Two points now stand out. One is when the list of the 13 affected contracts identified by ChainSecurity will emerge, and whether the Ethereum Foundation’s review expands to more categories of contracts.
The other is how the ACDC meeting handles the mainnet date. If the investigation stretches beyond November, the year-end launch window will narrow and could even slip into early 2027.
For contract developers, the immediate task is to check whether their code depends on fixed assumptions around gasleft(), especially along paths that write state after a failed call. The source article said those paths are the most exposed under EIP-8037 and EIP-8038.
Ethereum developers chose to stop at the testnet stage rather than carry the issue onto mainnet. That puts safety ahead of the calendar, but it also leaves the upgrade timeline uncertain again.