security flaw

Ethereum delays Glamsterdam test upgrade over security concerns

46Importance
no updates 6h+Status
10News media
10Pieces
Published
Updated
Since then
9 new reports

Ethereum developers delayed the Glamsterdam Hoodi testnet upgrade after security reviews turned up risks in gas accounting and existing smart contracts, and they also added a separate fix for a validator deposit bug to the upgrade specifications. The schedule now has no new activation date, while the validator-deposit change was merged after being rejected earlier and after further review and testing.

Key claims & sources

✓
Ethereum developers postponed the Glamsterdam upgrade on the Hoodi testnet after researchers identified security risks involving existing smart contracts.
✓
ChainSecurity said the Hoodi testnet fork was off after it found gas changes that could let contracts lock in failures, and it pointed to 13 real-world cases.
✓
Ethereum developers delayed the Glamsterdam hard fork deployment on Hoodi after security experts identified gas-accounting adjustments that could affect currently deployed smart contracts during failed transactions.
✓
Ethereum developers merged a Glamsterdam fix on Oct. 26 for a bug that could have credited a staker’s validator deposit to someone else’s builder account, one week after closing the same change for lack of client support.
✓
Developers added a fix to Ethereum’s upgrade specifications after further review and testing, after it had first been set aside.
✓
Ethereum developers postponed the Glamsterdam upgrade previously planned for the Hoodi testnet on October 26, with no revised activation date set.

What it means

Glamsterdam is Ethereum's next scheduled hard fork, bundling execution and consensus layer changes including new gas-accounting rules for failed transactions. Before any mainnet activation, the upgrade runs on Hoodi, Ethereum's public testnet, where client teams and auditors can catch bugs without risking real funds. ChainSecurity, an audit firm that has reviewed prior Ethereum forks, flagged that the proposed gas changes could let contracts lock in failure states, citing 13 real-world cases already on mainnet.

Validators, stakers and smart contract developers now wait without a fixed Hoodi date, meaning teams that build atop affected contracts cannot yet test against a stable fork target. The separately merged fix, finalized October 26 after being rejected a week earlier for lack of client support, closes a path where a staker's new validator deposit could have been credited to someone else's builder account. Stakers avoid that specific loss; client teams must now re-sync implementations around the restored change.

Shipping speed versus irreversible risk is the real trade-off here: Ethereum's roadmap runs on fixed-interval upgrade cycles, but a gas-accounting flaw touching 13 live contracts shows why audits can still override a calendar. Critics of frequent hard forks will point to this as evidence that complexity is outpacing review capacity; defenders will note the bug was caught on testnet, exactly where it should be. Either reading confirms that Ethereum's multi-client, multi-auditor process is slow by design, not by accident.

There is no revised Hoodi activation date as of the October 26 postponement, leaving the next concrete marker the announcement of a new testnet fork schedule from the Ethereum core developer calls. Watch whether the gas-accounting fix for the 13 flagged contracts gets merged alongside the already-restored validator-deposit patch, since both must clear review before any new Hoodi date, let alone a mainnet target, can be set.

Market reaction i

EthereumETH it is the asset of the company or protocol in the event
first headline
-0.3% 2 h before
+0.1% 4 h after
$2,400price at publication
12data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 23 05:17
+5 h 12 m
Oct 23 10:28
Cryptonews.com context
Its angle: blockchainlenny, approaching, researchers
+6 h 33 m
Oct 23 11:49
Decrypt context
Its angle: chainsecurity, failures, citing
+7 h 49 m
Oct 23 13:05
CR Cryptopolitan adds
Adds the identifier eip-8037, with quotes
+4 d 1 h
Oct 27 07:09
CoinDesk context
Its angle: vulnerability, incorporate, potentially
+4 d 3 h
Oct 27 08:54
crypto.news echo
No new facts: preventing, rejection, reverses
+4 d 4 h
Oct 27 09:45
Unchained context
Its angle: registered, newsletter, architect; with quotes
+4 d 8 h
Oct 27 13:24
Crypto Economy echo
No new facts: specification, misclassified, identifying
+4 d 10 h
Oct 27 15:18
AMBCrypto echo
No new facts: specifications, further, review
+5 d 15 h
Oct 28 21:00
NewsBTC echo
No new facts: implementation, investigation, announcement; with quotes

Has this happened before?

WhenWhat happenedFigure
7 days ago Obol Urges Immediate Charon Upgrade After CA Key Compromise event 1 actors in common · 2 news media
9 days ago Ethereum Developers Cancel Oct. 26 Glamsterdam Upgrade on Hoodi event 1 actors in common · 14 news media
9 days ago Lido Engineer Warns of Staking Deposit Hijack at Glamsterdam event 1 actors in common · 3 news media
10 days ago Vitalik Buterin proposes a new way to handle Ethereum cryptography event 1 actors in common · 3 news media
14 days ago Aztec Targets Full Post-Quantum Migration by End of 2030 event 1 actors in common · 3 news media