Ethereum’s long-awaited Glamsterdam upgrade hits another roadblock as 13 security risks emerge

Ethereum developers have postponed the Glamsterdam upgrade on a major test network after identifying potential security risks affecting existing smart contracts.

The Ethereum Foundation confirmed on Oct. 22 that the upgrade, scheduled for Oct. 26 on the Hoodi testnet, would no longer proceed as planned. Developers agreed to investigate how a proposed change to Ethereum's gas-accounting system could affect applications already operating on the blockchain.

The setback threatens Ethereum's efforts to deliver Glamsterdam before the end of 2026, after the upgrade was previously pushed beyond its original first-half target. Developers had considered several activation dates in early December, but had not finalized a mainnet schedule.

Christine Kim, founder of research firm Protocol Watch, initially disclosed the cancellation, urging affected Hoodi node operators to revert to older software versions or install updated execution clients that remove the scheduled activation.

The Foundation subsequently clarified that the decision followed discussions during the Oct. 22 All Core Developers Execution meeting, where participants agreed to conduct further investigations into EIP-8037 and its interactions with existing mainnet smart contracts.

The postponement also suspends the planned increase in Hoodi's gas limit to 200 million, which would have supported additional testing of Ethereum's ability to process substantially larger transaction volumes. The network's existing transaction history remains unaffected.

The postponement follows an Oct. 13 report from blockchain security firm ChainSecurity, which identified potential vulnerabilities arising from two proposed changes to Ethereum's gas-accounting system.

EIP-8037 introduces a separate gas reserve for creating blockchain state, while EIP-8038 changes the cost of accessing and modifying existing state. Both proposals aim to increase transaction capacity by aligning gas charges more closely with the resources smart contracts consume.

However, ChainSecurity warned that the changes could undermine safeguards used by existing applications to distinguish failed transactions from operations that should remain eligible for another attempt.

The firm subsequently disclosed that its investigation had already uncovered problems in deployed applications.

ChainSecurity said they “already found 13 real-world examples,” adding that it was conducting responsible disclosure with affected projects.