Ethereum pauses Hoodi Glamsterdam upgrade over eight contract risks

The concerns, identified by security firm ChainSecurity, relate to EIP-8037 and EIP-8038. The proposals change gas charges for creating and accessing blockchain state. Some contracts rely on fixed gas costs or on a failed operation leaving too little gas for later instructions to run. Under the revised accounting, certain operations could continue when developers expected a transaction to revert, potentially disrupting safeguards or preventing retries.

An Ethereum Foundation GitHub repository describes eight affected invariants, with examples and review guidance. Fixed gas budgets and reserves are among the most common concerns identified so far. Developers are being asked to inspect contracts as well as wallets, relayers and other off-chain systems that may use hardcoded gas limits. Reports can be sent privately to glamsterdam@ethereum.org and should include the affected contract, the invariant involved, possible fixes and tests where available.

The All Core Developers group is holding the Hoodi hard fork until the compatibility concerns are addressed. The activation, previously scheduled for October 26 at 17:42:48 UTC, was postponed without a replacement date. The Foundation said it is working with ChainSecurity and Dedaub and conducting internal audits, while acknowledging that reviews cannot cover every project or interaction with off-chain infrastructure. Developers may change EIP-8037 or EIP-8038 depending on feedback. Work on the later Hegota upgrade continues unaffected.

Glamsterdam activated on the Sepolia testnet on October 6, where developers began testing its scaling changes under a 200 million gas limit. The upgrade also includes proposer-builder separation through EIP-7732 and block-level access lists through EIP-7928. An earlier Foundation assessment said historical transaction replays left most contracts unaffected, though some needed higher gas limits or more substantial changes. A separate validator deposit fix was merged on October 26 to address a flaw that could credit staking deposits to block builders with the same public key.