# Ethereum Developers Postpone Glamsterdam Testnet Fork After ChainSecurity Finds 13 Contracts Exposed to New Gas Rules The Hoodi activation planned for October 26 has been cancelled with no replacement date, leaving Ethereum's main-network schedule for its next hard fork undetermined. - Published: 2026-10-23T05:49:02.326Z - Canonical: https://polylog.news/crypto/2026-10-23/ethereum-developers-postpone-glamsterdam-testnet-fork-after - Publisher: Polylog (Crypto desk) - Section: crypto - Sources: [Ethereum Foundation Blog](https://blog.ethereum.org/2026/10/22/glamsterdam-hoodi-delay), [CoinDesk](https://www.coindesk.com/tech/2026/10/23/ethereum-delays-glamsterdam-test-after-security-devs-flag-risk-to-existing-contracts), [crypto.news](https://crypto.news/ethereum-glamsterdam-hoodi-upgrade-postponed/), [CryptoSlate](https://cryptoslate.com/ethereums-long-awaited-glamsterdam-upgrade-hits-another-roadblock-as-13-security-risks-emerge/), [DeFi Prime](https://defiprime.com/glamsterdam-hoodi-delay-gas-failure-handlers), [Alchemy](https://www.alchemy.com/es/blog/glamsterdam-ethereum-upgrade), [24/7 Wall St.](https://247wallst.com/investing/cryptocurrency/2026/09/11/ethereums-glamsterdam-upgrade-slipped-again-sepolia-now-targets-october-6/) Ethereum client teams have cancelled the Glamsterdam upgrade on Hoodi, the last public test network before the main network. The fork had been set for October 26 at 17:42:48 Coordinated Universal Time (UTC), at epoch 132,352. The [Ethereum Foundation said](https://blog.ethereum.org/2026/10/22/glamsterdam-hoodi-delay) that no new activation date has been set and that its notice replaces the earlier Hoodi schedule and instructions. Developers made the decision on an October 22 coordination call, [CoinDesk reported](https://www.coindesk.com/tech/2026/10/23/ethereum-delays-glamsterdam-test-after-security-devs-flag-risk-to-existing-contracts). The delay followed a disclosure from ChainSecurity, a Zurich-based smart-contract auditor. The firm said its researchers had identified security risks in contracts that are already deployed. It counted 13 real-world examples and said it is notifying the affected projects privately before it publishes details, [according to DeFi Prime](https://defiprime.com/glamsterdam-hoodi-delay-gas-failure-handlers). The problem lies in Ethereum Improvement Proposal (EIP) 8037 and a companion proposal, EIP-8038. Both change how Ethereum prices gas and manages state. EIP-8037 makes an operation's cost depend on how much new permanent state it writes, which makes contract deployment and heavy storage writes more expensive, [Alchemy's developer guide explains](https://www.alchemy.com/es/blog/glamsterdam-ethereum-upgrade). The researchers showed that the new rules change how some existing contracts behave when a transaction runs short of gas. Today, such an operation usually reverts the whole transaction. Under the new rules, a contract that catches a failed internal call could [permanently record that failure](https://www.coindesk.com/tech/2026/10/23/ethereum-delays-glamsterdam-test-after-security-devs-flag-risk-to-existing-contracts) instead. Suppose a contract stores a failed payout, or marks a request as used, as a final result. Whoever chooses how much gas to supply for that transaction can then make the failure permanent. [CryptoSlate](https://cryptoslate.com/ethereums-long-awaited-glamsterdam-upgrade-hits-another-roadblock-as-13-security-risks-emerge/) reported that the risk falls on existing contracts. In most cases their code cannot be changed after deployment, and some of their authors no longer maintain them. Glamsterdam's schedule has slipped several times already. Its Sepolia testnet date was moved to October 6 after earlier delays, [24/7 Wall St. reported](https://247wallst.com/investing/cryptocurrency/2026/09/11/ethereums-glamsterdam-upgrade-slipped-again-sepolia-now-targets-october-6/). An earlier developer network exposed a consensus-layer bug serious enough to stop the chain. It also exposed an EIP-8037 implementation flaw that forced every execution-client team to revise its code, [Alchemy noted](https://www.alchemy.com/es/blog/glamsterdam-ethereum-upgrade). [crypto.news](https://crypto.news/ethereum-glamsterdam-hoodi-upgrade-postponed/) reported that no main-network date has been confirmed. The exposure is large. Ethereum holds $49.72 billion of the $90.69 billion locked in decentralized finance (DeFi), according to DeFiLlama data. Any change to how its existing contracts execute therefore reaches more than half of on-chain DeFi value. ## What this means A gas rule changed how old, unmodifiable code behaves. That puts at risk any contract that treats a caught out-of-gas failure as final, and the operators of bridges, relayers and account-abstraction wallets that hand gas control to a third party carry the most exposure. Developers want EIP-8037 because growth in stored state is the main long-run cost for node operators, but they cannot reprice state without either keeping today's revert behavior or accepting breakage in contracts they do not control. The direct precedent involves the same auditor. In January 2019 ChainSecurity showed that EIP-1283 would open reentrancy in deployed contracts. Developers postponed Constantinople a day before activation, removed the proposal, and shipped the fork about six weeks later. The market treats fork dates as soft, so the delay carries little price weight. Treating this as a routine testnet slip misses that Hoodi was the final rehearsal, and that a redesign of state pricing reopens client testing. The likelier outcome is that developers amend or split out EIP-8037 and EIP-8038, then reschedule Hoodi, which pushes Glamsterdam's main-network activation into 2027. That depends on whether a fix that keeps current revert behavior can be specified without another round of developer networks. The forward read is wrong if developers set a new Hoodi date within the next few coordination calls with both proposals unchanged. ## What to watch - ChainSecurity's full technical write-up after the affected projects patch. It will show which kinds of contracts (bridges, wallets, payment relayers) carry the risk and whether any hold large balances. - Whether core developers modify, defer or remove EIP-8037 and EIP-8038 on the next calls. Removal would preserve the schedule but leave state growth unpriced. - Whether layer-2 networks that copy Ethereum's gas schedule announce their own reviews. Inheriting the repricing would carry the same contract risk to Base, Arbitrum and OP Mainnet.