TL;DR
- Ethereum Devs: Core developers have postponed the Glamsterdam hard fork on the Hoodi testnet after security reviews identified risks tied to eight smart contract invariants.
- Smart Contract Risks: Findings from ChainSecurity showed that EIP-8037 and EIP-8038 may affect projects that depend on fixed gas-cost assumptions.
- Glamsterdam Upgrade: The upgrade remains active on the Sepolia testnet, but Hoodi will not fork until developers better understand affected projects.
Ethereum devs have delayed the implementation of the Glamsterdam upgrade on the Hoodi testnet after security researchers identified potential smart contract vulnerabilities linked to upcoming gas-pricing changes. Ethereum Devs confirmed the pause following findings that certain applications may rely on assumptions that would no longer hold after the activation of EIP-8037 and EIP-8038. According to the Ethereum Foundation, Ethereum developers will keep Hoodi on hold until the issues are fully understood and addressed, giving the ecosystem more time to assess the impact of the proposed changes.
Security Findings Trigger Delay
The decision came after a report from ChainSecurity highlighted concerns surrounding eight smart contract invariants that could be broken under Glamsterdam. The researchers found that some projects depend on fixed gas-related assumptions, particularly in scenarios involving failed external calls. Because EIP-8037 and EIP-8038 change how gas is charged for specific operations and state-related activity, those assumptions may no longer remain valid.
In response, Ethereum Devs chose to postpone the Hoodi fork rather than move forward with unresolved risks. The Ethereum Foundation stated that the delay will provide additional time to identify vulnerable contracts and evaluate whether protocol-level adjustments are necessary. At the same time, Ethereum Devs emphasized that work on Hegota continues independently and is not affected by the decision.
Audits and Community Review Underway
To better understand the scope of the issue, Ethereum Devs are working with auditing firms including ChainSecurity and Dedaub while also conducting internal reviews. However, the Foundation noted that it cannot independently examine every Ethereum project or all associated onchain and offchain code.
As part of the process, Ethereum Devs issued a call for contract developers and auditors to review their own applications. The Foundation also published a repository containing the eight invariants believed to be affected by Glamsterdam. By encouraging broader participation, Ethereum Devs hope to gather enough information to support a practical decision during future AllCoreDevs discussions.
Glamsterdam Testing Continues Elsewhere
Although Hoodi has been paused, Ethereum Devs continue testing Glamsterdam on other networks. The upgrade went live on the Sepolia testnet on Oct. 6 as one of its final major testing stages. The broader goal of the upgrade remains unchanged. Ethereum Devs are pursuing improvements that support Ethereum’s layer-1 scaling roadmap, including enshrined proposer-builder separation, block-level access lists and updated gas-pricing mechanisms designed to better reflect execution costs. Until the current concerns are resolved, Ethereum Devs will keep the Hoodi rollout on hold.
