Ethereum Postpones Glamsterdam Hoodi Testnet Activation After ChainSecurity Flags 13 Mainnet Contracts Vulnerable Under Proposed Gas Changes

The postponement highlights the constant structural friction between raising network throughput and protecting immutable legacy smart contract code from systemic execution failures.

• The testnet launch paused: Ethereum core developers called off the October 26, 2026 activation of the Glamsterdam upgrade on the Hoodi testnet during ACDE meeting #248.
• Vulnerabilities surfaced: Security firm ChainSecurity discovered that changes to gas accounting under EIP-8037 and EIP-8038 could push 13 active mainnet smart contracts into permanent failure states.
• Mainnet targets shifted: With the Hoodi activation paused and client software adjustments required, the tentative December 2026 mainnet deployment window now faces scheduling uncertainty.

• Scaling targets collide with history: Glamsterdam aims to expand transaction capacity by testing a gas limit of roughly 200 million on testnets—more than three times the mainnet's baseline of approximately 60 million.
• Sepolia tested cleanly first: The initial testnet rollout on Sepolia succeeded on October 6, 2026, meaning the flaw sits inside specific accounting rules rather than baseline node consensus stability.
• State growth prompted the shift: Both EIP-8037 and EIP-8038 were engineered to refine gas accounting for state creation and access, aiming to manage the database footprint of the network as transaction volume grows.

The core tension on Ethereum is that you cannot retroactively patch immutable code once it hits the blockchain. When core developers alter the underlying virtual machine's economics, every line of logic written under older assumptions must continue working as originally intended.

The Glamsterdam hard fork couples two core goals: expanding execution throughput and curbing database bloat. To do that, the upgrade introduces EIP-8037 and EIP-8038, which overhaul how the Ethereum Virtual Machine (EVM) prices state creation and data access. The goal is to charge users accurately for the long-term hardware costs their data imposes on node runners. Alongside these accounting tweaks, developers planned to test a 200-million gas limit on the Hoodi testnet, a major bump over the mainnet standard of roughly 60 million.

However, ChainSecurity's October 13, 2026 audit uncovered a fatal side effect within these gas repricing mechanisms. A smart contract frequently executes "subcalls"—nested instructions that trigger external contracts. Many production systems incorporate error-handling routines: if a subcall runs out of gas or fails, the transaction catches the failure, reverts the inner step, and triggers an alternate pathway or a retry routine.

Under the proposed gas changes, the shifts in execution fees and refund structures alter the exact gas returned to the parent contract. ChainSecurity confirmed that in 13 live mainnet contracts, this shift allows subcalls that previously failed safely to execute partial, corrupted failure-handling logic. Instead of rolling back cleanly, the affected contracts process the failure as resolved, locking their internal states into irreversible dead ends.

During the All Core Developers Execution meeting (ACDE #248) on October 22, 2026, developers chose protocol safety over scheduling velocity. Rather than proceeding with the scheduled activation at Hoodi epoch 132,352, the Ethereum Foundation and client teams stripped the activation rules from their client releases.

For the broader market, the immediate impact remains contained. Ether traded steadily near $2,296 following the announcement because the pause occurred early in the deployment pipeline. But this decision reveals the ongoing trade-off Ethereum faces: client teams cannot easily raise throughput without risking the architectural foundation of the applications already running on the ledger.

• Protocol engineering teams: Must wait for clear client specifications on gas repricing before finalizing smart contract architectures reliant on subcall return data.
• Node and testnet operators: Required to update their client configurations immediately to decouple Hoodi nodes from the canceled October 26 activation logic.
• Institutional capital allocators: Face longer horizons for planned layer-1 capacity improvements, keeping fee dynamics pinned to existing limits.
• Dubai and global retail holders: Experience zero direct friction; mainnet assets, balances, and operational contracts remain completely untouched.

• Core developer consensus updates: Monitor subsequent ACDE calls to see whether developers modify EIP-8037 and EIP-8038 or decouple them entirely from the Glamsterdam package.
• Responsible disclosure resolutions: Watch for ChainSecurity and affected teams to release technical post-mortems once mitigation steps for the 13 flagged contracts are established.
• Hoodi testnet rescheduling: The posting of a new activation epoch will indicate that client teams have resolved the gas calculation edge cases.