Ethereum’s Glamsterdam Upgrade Faces Further Delays as Security Audit Uncovers 13 Vulnerabilities in Smart Contracts

Ethereum developers have postponed the highly anticipated Glamsterdam upgrade on the Hoodi testnet after discovering potential security risks that could impact existing smart contracts on the network.

The Ethereum Foundation announced on October 22 that the upgrade, originally slated for October 26 on the Hoodi testnet, has been postponed. Developers have agreed to investigate how proposed modifications to Ethereum’s gas-accounting system might affect applications currently operating on the blockchain.

This setback threatens Ethereum’s timeline for delivering the Glamsterdam upgrade before the end of 2026, following previous delays that pushed the project beyond its initial first-half target. While developers had considered several mainnet activation dates in early December, no official schedule had been finalized.

Christine Kim, founder of the research firm Protocol Watch, initially revealed the cancellation, advising affected Hoodi node operators to revert to older software versions or install updated execution clients that remove the scheduled activation.

The Foundation later clarified that this decision stemmed from discussions during the October 22 All Core Developers Execution meeting, where participants agreed to conduct further investigations into EIP-8037 and its potential interactions with existing mainnet smart contracts.

The postponement also suspends the planned increase in Hoodi’s gas limit to 200 million, which was intended to support further testing of Ethereum’s capacity to handle significantly larger transaction volumes. The network’s existing transaction history remains unaffected.

Security Warnings Threaten Ethereum’s December Upgrade Target

The postponement follows an October 13 report from the blockchain security firm ChainSecurity, which identified potential vulnerabilities stemming from two proposed changes to Ethereum’s gas-accounting system.

EIP-8037 introduces a separate gas reserve for creating blockchain state, while EIP-8038 alters the cost of accessing and modifying existing state. Both proposals are designed to increase transaction capacity by aligning gas charges more closely with the actual resources consumed by smart contracts.

However, ChainSecurity warned that these changes could undermine the safeguards used by existing applications to distinguish failed transactions from operations that should remain eligible for retry.

The firm subsequently disclosed that its investigation had already uncovered issues in deployed applications.

ChainSecurity stated that they had “already found 13 real-world examples,” adding that they are conducting responsible disclosure with the affected projects.

The security firm urged developers to review their contracts immediately as the Ethereum Foundation investigates how many applications are exposed to these proposed changes and what the potential consequences might be.

The findings affect decentralized finance (DeFi) applications that handle withdrawals, batched transactions, and other operations requiring automated failure recovery.

Under Ethereum’s existing execution rules, a failed operation that consumes its allocated gas can leave insufficient resources for the calling contract to complete its failure-handling instructions, forcing the broader transaction to revert.

Glamsterdam’s proposed changes could alter this behavior by making some gas available again during execution. Consequently, contracts that would have previously reverted could instead complete instructions, recording an operation as permanently unsuccessful.

This creates an opportunity for attackers to deliberately trigger insufficient-gas failures while allowing affected contracts to record the result, potentially preventing users from retrying otherwise valid operations.

The discovery has intensified scrutiny of Glamsterdam’s compatibility with existing applications, adding another obstacle to an upgrade that has already missed its original deployment window.

In February, the Ethereum Foundation targeted the first half of 2026 for Glamsterdam, with another major network upgrade, Hegotá, expected later in the year.

That schedule subsequently slipped, and by September, developers were working toward a December activation for Glamsterdam.

The upgrade is expected to introduce enshrined proposer-builder separation and block-level access lists, changes intended to improve transaction processing and support greater network capacity without imposing disproportionate demands on node operators.

Before the latest postponement, the October 22 core developers’ meeting agenda identified December 1, December 8, and December 9 as potential mainnet activation dates. Developers had planned to settle on a date the following week, following Hoodi testing.

The cancellation disrupts that sequence, narrowing the window for completing the upgrade before year-end and potentially complicating preparations for Hegotá, the next major network overhaul.

Source link