Ethereum developers have postponed the Hoodi testnet activation of Glamsterdam after ChainSecurity identified security risks in two proposed gas-accounting changes. No replacement date has been announced, and Ethereum’s mainnet activation remains unconfirmed.
The concern centers on EIP-8037, which changes the cost and accounting of creating permanent records in Ethereum’s database, and EIP-8038, which updates charges for accessing stored state. Under the proposed rules, some contracts could receive more usable gas after a failed operation than they would under the current system, potentially allowing a failure-handling path to continue when it previously would have reverted. In the opposite direction, other operations could require substantially more gas and fail despite using an existing budget.
The issue affects contracts that rely on gas behavior to catch failed calls, disable actions, or continue processing. ChainSecurity identified 13 real-world examples of potentially affected contracts and began coordinating disclosure with the relevant projects, but no major production protocol has been publicly shown to be exploitable through the proposed changes.
Ethereum researchers from Eth Labs and the Ethereum Foundation used AI agents to scan contracts for vulnerabilities. After discovering that they were using similar methods, they created a shared GitHub message board for the agents to coordinate findings. A second board was later established to examine EIP-8198, known as Quick Slots, which has been proposed for a later hard fork.
Glamsterdam combines execution- and consensus-layer changes intended to improve block processing, including proposer-builder separation and block-level access lists. Its gas changes are designed to price permanent state and state access more accurately, but the Hoodi delay shows that those adjustments must be tested against software already deployed on Ethereum before the fork can proceed.
A separate security challenge involving a website called Steal My Bitcoin ended after a participant known as KillerBoi extracted a private key from the unpatched site. The key did not correspond to the wallet address displayed on the site, and organizer James Pavur said the funds would be transferred. The challenge had hidden access to a Bitcoin wallet worth about $2,000 and periodically went offline under heavy traffic and probing.