security flaw

EIP-8037/EIP-8038 Glamsterdam

46Importance
no updates 6h+Status
5News media
5Pieces
Published
Updated
Since then
3 new reports

Ethereum developers paused the Hoodi testnet fork for Glamsterdam while they review eight smart contract assumptions tied to EIP-8037 and EIP-8038. The review follows findings that some projects and systems may behave differently after the upgrade even if their code does not change.

Key claims & sources

✓
Chainsecurity identified projects that would be vulnerable after Glamsterdam because they rely on invariants that EIP-8037 and EIP-8038 change.
✓
EIP-8037 and EIP-8038 rework how much gas is charged for certain operations and how gas is charged for state.
✓
The Hoodi testnet upgrade remains paused, and no mainnet activation date has been confirmed.
✓
On November 6, 2026, the Ethereum Foundation asked smart-contract developers and auditors to test their systems against eight gas-related assumptions that the proposed changes could break.
✓
Ethereum developers have delayed the Glamsterdam upgrade on the Hoodi testnet after researchers identified eight existing smart contract assumptions that could become invalid under the proposed gas-accounting changes.

What it means

Teams running contracts with fixed gas budgets or reserves now have to re-test against eight specific assumptions the Ethereum Foundation published on November 6, 2026, rather than wait for an audit cycle tied to a mainnet date. Multisig wallets, relayers and any system that hard-codes a gas stipend for sub-calls are the likely casualties if they skip this step. Auditors gain a concrete checklist; protocol teams lose the ability to treat Glamsterdam as a fixed-date release.

A contract that never changes its bytecode can still change its behavior once the gas rules underneath it move, which cuts against the assumption that deployed code is a fixed, auditable contract with the chain. That is a narrower version of the 2019 debate, but it recurs every time Ethereum adjusts opcode pricing: efficiency gains at the base layer can quietly invalidate security assumptions several layers up, and no amount of code review catches that unless the invariants are tested explicitly, as Chainsecurity's findings show.

The Hoodi testnet fork stays paused with no mainnet activation date confirmed, so the next marker is whether the Ethereum Foundation's eight-point review closes out the open invariants from the November 6 post. A clean resolution restarts the Hoodi schedule and puts a mainnet date back on the table; further vulnerable contracts surfacing would push EIP-8037 and EIP-8038 back for redesign rather than just more testing time.

Market reaction i

EthereumETH it is the asset of the company or protocol in the event
first headline
+0.4% 2 h before
-0.4% 4 h after
$2,235price at publication
12data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 6 10:15
Ethereum Foundation blog scoop our clock
Breaks the event
+12 min
Nov 6 10:27
The Defiant context
Its angle: activation, confirmed, findings
+3 h 7 m
Nov 6 13:23
Cointelegraph context
Its angle: investigating, concerns, resolved
+3 h 17 m
Nov 6 13:32
MEXC context
Its angle: announcement, postponement, differently
+3 h 53 m
Nov 6 14:09
crypto.news echo
No new facts: researchers, existing, invalid