Ethereum Delays Glamsterdam on Hoodi After Identifying Eight Vulnerable Invariants
Key Facts
Ethereum development teams decided to delay the Glamsterdam upgrade rollout and not activate it on the Hoodi testnet until issues involving gas fee changes are resolved, the Ethereum Foundation said on November 6, 2026. The foundation said ChainSecurity had identified projects that could become vulnerable after EIP-8037 and EIP-8038 take effect. It asked contract developers and auditors to check whether their projects rely on any of eight invariants that the changes could break. The changes involve resetting fees for some operations and changing how gas fees tied to network state are calculated. The foundation said developers are working to identify what could break and whether changes to the specifications could prevent it.
The number of invariants does not mean the audit found eight affected projects; the foundation said ChainSecurity identified “some projects” that could become vulnerable, then urged developers to check whether their code relies on the eight invariants. The foundation made available a repository explaining those invariants and containing examples and questions to help with the checks. The review focuses on contracts whose behavior could change when the cost of state operations or the amount of gas available to execute their paths changes. ChainSecurity explains that the gas remaining after a failed external call could change under the new rules. That could allow a failure path that previously reverted to complete, according to the company’s analysis. The foundation therefore asked developers to review the contracts and protocols concerned before the upgrade rollout resumes.
EIP-8037 separates state creation fees, while EIP-8038 reprices access to state, according to the foundation’s description of the proposals. In an example cited by ChainSecurity, creating a new storage slot costs 97,920 state gas. EIP-8038 adds execution fees to that cost, bringing the execution fee for writing to a new cold slot to 12,100, alongside 97,920 state gas. The company says changes to gas accounting could affect paths that depend on the amount of gas available after unsuccessful calls. In August, the foundation said replaying historical mainnet transactions under the proposed gas schedule showed a small group of contracts relying on assumptions that change under the schedule. It added that most of the issues identified could be addressed by raising the gas limit, and that the vast majority of smart contracts were unaffected.
Gas fees for state operations were last adjusted with the Berlin upgrade in 2021, according to an explanation published by the foundation on August 24, 2026. It said Ethereum’s state growth and higher gas limits since then had increased the need to align fees with the actual cost of operations. The new fee schedule was designed around a performance target that supports an approximately threefold increase in base throughput, it added, and repricing is a prerequisite for raising the gas limit later. One assumption that could be affected is allocating a fixed amount of gas, such as 2,300 gas in a Solidity transfer or send. Other cases include using specific gas values in calls or branching contract logic based on remaining gas. The foundation urged developers to review code that hard-codes these values or relies on available gas.
Glamsterdam was scheduled to activate on Hoodi on October 26, 2026, but the foundation postponed the date and did not announce a replacement. The previous schedule included raising the network’s gas limit to 200 million upon activation, but the delay removed that schedule from Hoodi’s configuration. The decision applies to the testnet and requires no action from Ethereum mainnet users or ETH holders, according to the foundation. The upgrade had been activated on the Sepolia testnet on October 6, before the Hoodi-specific delay was announced. The foundation also said work on Hegota is continuing in parallel and will not be affected by the delay. Ethereum’s roadmap, published on November 5, lists Glamsterdam among the upgrades targeted for the fourth quarter of 2026, while placing Hegota in 2027.
The foundation said it is using ChainSecurity and Dedaub for the audit, along with internal reviews, but cannot cover every project on Ethereum or its off-chain code. That means contract developers and auditors are also responsible for checking whether contracts rely on the invariants, in line with the foundation’s call. The foundation had made the Platåberget test network available to test the new fee schedule and urged layer 1 developers to test fixes and review any logic that branches based on remaining gas. Meanwhile, developers continue to identify what could break and whether specification changes will address the issue. They had not set a new date for Hoodi activation as of the November 6 announcement. The announcement did not give a date for Glamsterdam’s mainnet activation.