Ethereum developers have postponed the planned activation of the network's Glamsterdam upgrade on its Hoodi test network after security firm ChainSecurity found problems with how the upgrade changes gas, the auditor said on Thursday.

The upgrade had been due to go live on Hoodi on Monday. According to ChainSecurity, the changes could let some smart contracts permanently record failed operations that their code was designed to keep retryable.

Public testnets such as Hoodi are rehearsal environments where Ethereum activates planned upgrades under live conditions before mainnet, so issues surfacing at this stage are the staging process working as intended.

"It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified," ChainSecurity wrote, adding that it had "already found 13 real-world examples" and was in responsible disclosure with the affected projects.

⚠️ It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified in this blog post: We already found 13 real-world examples and are in responsible disclosure with the affected projects. Please… — ChainSecurity (@chain_security) October 22, 2026

ChainSecurity said it is contacting the affected projects as the Ethereum Foundation assesses how many contracts are exposed. Responsible disclosure is the practice of privately reporting a flaw to affected teams so they can address it before details circulate widely.

Node operators should revert to an older software release without the upgrade scheduled, or wait for their execution client team to release a new version that cancels it, Ethereum researcher Christine Kim said. Preston Van Loon, a developer on the Prysm consensus client, said a Prysm release removing the upgrade from Hoodi's schedule would follow the same day. Because hard forks rewrite the network's rules and require every node to run compatible software, both activation and rollback happen through coordinated client releases.

Why the gas changes raised concerns

Gas is the fee paid for computing work on Ethereum. Glamsterdam changes how the network charges for creating and accessing stored data through two proposals, EIP-8037 and EIP-8038, and introduces a separate pool of gas for creating new state. Ethereum Improvement Proposals, or EIPs, are the network's standard format for specifying protocol changes.

According to ChainSecurity's analysis, those changes break assumptions that many contracts rely on when an external call fails. Some contracts use gas checks, or rely on the call running out of gas, to stop an attacker from deliberately supplying too little gas so that a valid operation fails and is recorded as a permanent failure — a tactic known as insufficient gas griefing.

Under Glamsterdam, gas can be refilled or returned to a contract after a failed call, and repricing can change how much gas a call needs, the firm found. "Even with unchanged contract code, a failure path that previously reverted can now complete," it wrote.

ChainSecurity urged projects to check their contracts, saying the Ethereum Foundation is working out how many are affected.

Glamsterdam's road to mainnet

Glamsterdam has already gone live on Sepolia, another Ethereum test network, which activated the upgrade on October 6 and began producing blocks with a gas limit of nearly 200 million — more than three times mainnet's 60 million.

The upgrade also adds block-level access lists, which let computers check transactions in parallel, and moves the auction that decides who assembles each block into Ethereum's own rules.

Developers had aimed to ship Glamsterdam on mainnet by the end of 2026, ahead of Hegotá, the next upgrade, which is expected in 2027 and could add native privacy features.

No new date has been set for the Hoodi fork. The next signals to watch are further client releases withdrawing the upgrade from testnet schedules, the Foundation's tally of exposed contracts, and any rescheduled Hoodi activation.