November 09, 2026 – Core developers have frozen the upgrade’s next testnet step after auditors found eight gas assumptions that the new pricing would break.
In Summary
Ethereum developers postponed Glamsterdam’s Hoodi testnet fork, first set for October 26.
EIP-8037 and EIP-8038 break eight gas assumptions that some contracts rely on.
A cold write to a new storage slot will cost about five times as much gas.
No mainnet date exists, and the two EIPs could still change after feedback.
Ethereum’s next major upgrade, Glamsterdam, has hit a security snag. In a November 6 post, Ethereum Foundation developer Marius van der Wijden flagged the problem. He said auditors at ChainSecurity found “a few projects” that would be vulnerable after the fork. Core developers have now paused the rollout until they resolve those issues.
The trouble sits in two gas proposals. EIP-8037 raises and separately meters the cost of creating state. EIP-8038, in turn, raises the cost of accessing it. Together, they break eight assumptions that some smart contracts make about gas.
Glamsterdam itself is a large package. It bundles 18 scheduled EIPs, led by enshrined proposer-builder separation and block-level access lists. Moreover, its gas changes aim to make fees better reflect real resource use. That goal now collides with code written for today’s prices.
Why Glamsterdam’s gas rules matter
Gas is the fee unit for every action on Ethereum. Yet many contracts hard-code gas amounts or check the gas left before acting. Glamsterdam, however, changes those numbers sharply. According to the foundation’s invariants repository, a cold write to a new storage slot jumps from 22,100 gas to 110,020. That is about five times the old price.
Account creation moves even more. Sending value to an empty address costs 25,000 gas today. Under Glamsterdam, it needs 183,600 in state gas plus execution. Meanwhile, the 2,300 gas stipend of Solidity’s transfer and send can no longer create a storage slot.
Eight invariants under review
Auditing firm ChainSecurity traced how the changes affect contracts that keep running after a failed call. Still, its key finding is subtle. A new “state-gas reservoir” travels with calls in full, so code after a failure can still write to storage. As a result, a griefing attacker could turn a retryable action into a permanent failure.
Overall, the repository lists eight cases. Some come from new prices, such as fixed gas budgets that no longer suffice. Others come from new accounting, such as gas that can rise during a call. So far, most findings involve fixed gas amounts and fixed gas reserves. The repository also urges care with first-time recipients, such as a new token balance. The reservoir only exists when a transaction’s gas limit tops 16,777,216.
Importantly, the risk is not only on-chain. The foundation warns that off-chain parts, such as tools that read receipts, could also break. It has asked teams to check their code and email findings to glamsterdam@ethereum.org.
Glamsterdam’s Hoodi fork on hold
The timeline has already slipped. Glamsterdam went live on the Sepolia testnet on October 6, the foundation said. The Hoodi fork came next, set for October 26 with a 200 million gas limit. However, developers postponed it on All Core Devs Execution call #248. They wanted more time to study how EIP-8037 hits mainnet contracts.
So far, no new Hoodi date exists, and the foundation never set a mainnet date. The foundation says work on the next upgrade, Hegota, continues in parallel. Depending on the feedback, developers may slightly change EIP-8037 and EIP-8038 or keep them as written.
What it means for users and builders
For regular ETH holders, nothing changes yet. The foundation said mainnet users need to take no action after the Hoodi delay. Builders, by contrast, face a different task. Teams that rely on hard-coded gas limits, bots, relayers or signed messages should test now. Ether traded near $2,237 on November 7, about 1.5% below its November 3 close on Kraken.
