Ethereum Postpones Glamsterdam Testnet Upgrade Following Security Concerns Over Gas Accounting Changes

Ethereum's highly anticipated Glamsterdam upgrade, slated for activation on the Hoodi test network, has been officially postponed. The decision came after security researchers highlighted critical vulnerabilities linked to new gas-accounting rules, which could significantly alter the behavior of existing smart contracts and potentially lead to unforeseen errors or failures. The delay underscores the Ethereum development community's stringent commitment to network security and stability, prioritizing thorough vetting over rushed deployment.

The Glamsterdam upgrade was originally scheduled to go live on the Hoodi test network on October 26 at 17:42:48 UTC. However, during a recent All Core Devs Execution meeting, developers chose to halt the rollout. This proactive measure was taken to allow for an in depth investigation into how proposed changes to Ethereum's gas accounting mechanisms interact with the vast array of smart contracts already deployed and functioning on the main network.

At the heart of these concerns are Ethereum Improvement Proposals (EIPs) 8037 and 8038. EIP-8037 specifically targets how Ethereum charges for the creation of new records within its vast database. The primary intention behind this proposal is to manage and limit the growth of the blockchain's state, a critical factor for network scalability as Ethereum continues to increase its transaction processing capacity.

However, findings by the security firm ChainSecurity, published on October 13, revealed potential adverse interactions between EIP-8037 and EIP-8038. Their analysis indicated that these proposed changes could inadvertently lead to situations where smart contracts end up with either more or less gas than their developers originally anticipated. Each operation, from a simple token transfer to a complex DeFi transaction, consumes a certain amount of gas.

The potential for unintended gas discrepancies presents two primary risks. Firstly, under the proposed Glamsterdam rules, gas that was initially used to create certain records might be restored if those changes are subsequently undone during a transaction. This restoration could leave a contract with a surplus of gas, enough to complete failure-handling operations that, under current rules, would have exhausted their gas budget and thus caused the entire transaction to revert. Many smart contracts are designed with explicit error-handling logic that relies on the expectation of gas exhaustion to trigger a full reversal, preventing partial or erroneous states. If such a reversal mechanism is bypassed due to unexpected gas availability, it could lead to permanent recording of failed operations, disrupting the contract's intended state and potentially causing significant financial losses or operational chaos for decentralized applications (dApps).

Conversely, ChainSecurity also identified a risk where contracts could experience a deficit of gas, or face significantly higher costs than expected. Their calculations illustrated a stark difference in gas requirements for creating a new storage slot: 110,020 gas under the proposed rules when a separate allowance is exhausted, compared to a mere 22,100 gas under the existing framework. This massive increase could cause contracts that operate under an existing, carefully budgeted gas allowance to fail while attempting to execute what would otherwise be a perfectly valid operation. For complex DeFi protocols or intricate multi-step transactions, such an unexpected failure could lead to locked funds, incomplete state changes, or even systemic issues within interconnected applications.

This highlights the indispensable role of security research and rigorous testing in the blockchain ecosystem, especially for a network as critical as Ethereum.

The Glamsterdam upgrade itself encompasses several other significant improvements beyond these gas-accounting changes. These include a new system for choosing block builders, aimed at enhancing network decentralization and censorship resistance, as well as general improvements designed to enable the Ethereum network to handle larger transaction blocks. The upgrade had already completed its activation on the Sepolia testnet on October 6, a significant milestone. Hoodi was intended to be the next public rehearsal, including a planned increase in its gas limit to 200 million, a feature also now postponed in light of the security concerns.

This delay, while temporarily halting progress on a major upgrade, is a testament to the meticulous and security-conscious development ethos that underpins Ethereum. Developers are committed to ensuring the network's integrity and the safety of its users' assets. Rushing a significant protocol change that could introduce subtle yet devastating vulnerabilities to existing smart contracts would be a profound disservice to the entire ecosystem. The unconfirmed mainnet upgrade date for Glamsterdam, coupled with the lack of a replacement date for the Hoodi test, indicates that a comprehensive review and potential revisions to EIP-8037 and EIP-8038 are now underway. The community eagerly awaits updates on the investigation and the revised timeline for this pivotal Ethereum upgrade, understanding that such delays are ultimately for the greater good of the network's long term health and reliability.

Source: CoinDesk — https://www.coindesk.com/tech/2026/10/23/ethereum-delays-glamsterdam-test-after-security-devs-flag-risk-to-existing-contracts