Ethereum's Glamsterdam Testnet Fork Delayed Due to Gas Security Issues

Ethereum Testnet Upgrade Delayed Due to Security Concerns

Ethereum developers have postponed the planned activation of the network’s Glamsterdam upgrade on its Hoodi test network following the discovery of security vulnerabilities related to gas fee changes, according to a statement from security firm ChainSecurity on Thursday.

“It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified,” ChainSecurity stated. The firm added that it had “already found 13 real-world examples” and was engaged in responsible disclosure with the affected projects.

The upgrade was originally scheduled to go live on Hoodi on Monday. Ethereum researcher Christine Kim advised node operators to revert to an older software release that does not include the upgrade, or to await a new version from their execution client team that cancels the scheduled activation. Preston Van Loon, a developer on the Prysm consensus client, indicated that a Prysm release removing the upgrade from Hoodi’s schedule would be issued the same day.

Gas is the fee paid for computational work on Ethereum. The Glamsterdam upgrade introduces changes to how the network charges for creating and accessing stored data through two proposals, EIP-8037 and EIP-8038, and establishes a separate gas pool for the creation of new state.

ChainSecurity’s analysis suggests that these modifications disrupt assumptions upon which many smart contracts depend when an external call fails. Some contracts utilize gas checks, or rely on calls running out of gas, to prevent attackers from deliberately supplying insufficient gas to cause a valid operation to fail and be recorded as a permanent error, a tactic known as insufficient gas griefing.

Under the Glamsterdam upgrade, gas can be refilled or returned to a contract after a failed call, and repricing can alter the gas cost of a call, the firm found. “Even with unchanged contract code, a failure path that previously reverted can now complete,” ChainSecurity noted. The firm urged projects to review their contracts, stating that the Ethereum Foundation is assessing the extent of the impact.

Glamsterdam has already been implemented on Sepolia, another Ethereum test network, which activated the upgrade on October 6. Sepolia began producing blocks with a gas limit of nearly 200 million, more than triple the mainnet’s limit of 60 million. The upgrade also incorporates block-level access lists, enabling parallel transaction checking by computers, and integrates the process for determining block assemblers into Ethereum’s core rules.

Developers had intended to deploy Glamsterdam on the mainnet by the end of 2026, preceding the next upgrade, Hegotá, which is anticipated in 2027 and may introduce native privacy features. A new date for the Hoodi fork has not yet been announced.