Ethereum Delays Hoodi Upgrade Due to Gas Security Bug

EthereumETH-0.07% Pauses Hoodi Testnet Upgrade After Security Warning

Ethereum developers have officially hit the pause button on the planned Glamsterdam upgrade for the Hoodi test network. The hard fork was originally scheduled to go live on Monday, October 22, 2026. However, developer teams called it off after security auditing firm Chain Security uncovered vulnerabilities in how the upgrade handles network gas.

According to Chain Security, the issue centers on changes to Ethereum's gas fee rules. These changes could accidentally allow certain smart contracts to permanently log failed transactions that were originally designed to be retried.

It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified. We already found 13 real-world examples and are in responsible disclosure with the affected projects.

What Is Gas and Why Did the Security Issue Happen?

To understand this issue, it helps to think of gas as the computing energy or fee required to execute operations on the Ethereum network. Whenever you transfer funds or interact with a smart contract, you pay gas to cover that work.

The Glamsterdam upgrade introduces two key technical proposals: EIP-8037 and EIP-8038. Together, these proposals change how the network charges for creating and accessing stored data. They also introduce a separate gas pool dedicated strictly to creating new state data.

While these updates aim to improve network efficiency, security auditors found that they break safety assumptions built into existing smart contracts. Many contracts rely on specific gas checks or count on a transaction running out of gas to stop malicious actors. One known attack method is called insufficient gas griefing, where an attacker intentionally supplies too little gas so a valid operation fails permanently.

Under Glamsterdam's new rules, gas can actually be returned or refilled to a smart contract after a failed call. Additionally, fee repricing alters the amount of gas a call requires. Chain Security noted that even without modifying a contract's code, a path that previously failed safely could now complete with unintended results.

How Many Smart Contracts Are Affected?

So far, Chain Security has uncovered 13 real-world smart contracts impacted by this gas flaw. The auditing firm is privately contacting the affected teams to help them resolve the issue.

At the same time, the Ethereum Foundation is actively evaluating the network ecosystem to calculate how many other smart contracts might be exposed to similar risks.

Action Required for Ethereum Node Operators

Because the upgrade on the Hoodi testnet is postponed, developers are instructing node operators to take simple steps to keep their client software synced correctly.

Ethereum researcher Christine Kim advised node operators to revert to an older software release without the Glamsterdam schedule. Alternatively, operators can wait for their software client team to issue a fresh update that cancels the activation.

Preston Van Loon, a developer for the Prysm consensus client, confirmed that a new Prysm software release removing the Hoodi upgrade schedule would roll out on the same day.

What Else Does the Glamsterdam Upgrade Include?

Despite the delay on Hoodi, Glamsterdam brings several major improvements to Ethereum's performance and architecture. Key highlights include:

• Separate State Creation Gas Pool: Creates dedicated fee structures for generating and retrieving stored network data.
• Block-Level Access Lists: Enables computers validating the network to inspect transactions in parallel, improving speed.
• In-Protocol Block Auctions: Moves the auction process that decides who builds each block directly into Ethereum's base rules.
• Successful Sepolia Test: Activated on the Sepolia testnet on October 6, 2026, reaching a gas limit of nearly 200 million—more than three times mainnet's 60 million limit.

Ethereum Roadmap and Future Outlook

Catching vulnerabilities on testnets like Hoodi and Sepolia demonstrates why rigorous testing exists. Finding flaws early ensures that smart contracts remain safe before changes reach Ethereum mainnet.

Core developers originally planned to launch Glamsterdam on mainnet by the end of 2026. This step paves the way for Hegotá, the following upgrade expected in 2027, which aims to add native privacy capabilities to the network.

No new target date has been announced for the Hoodi testnet fork yet. Developers will reschedule once the gas fee mechanisms are fully updated and re-tested. You can track current market movements on Bitkub Market. Please note that past performance of digital assets is not a guarantee of future performance.