• Ethereum’s core developers have held back the next upgrade, Glamsterdam, from the Hoodi test network after an audit firm found a small number of projects would break.
  • Two proposals in the upgrade, EIP-8037 and EIP-8038, change what certain operations cost to run. Contracts built around the old costs can fail.
  • Nothing has been exploited and no funds are at risk. This was found before deployment, and there is no confirmed date for the upgrade reaching the main network.

Ethereum upgrades normally reach a public test network long before anyone argues about the details. This one has been stopped short of that. Auditors found that two of the changes inside Glamsterdam would break assumptions already baked into running today.

None of this touches coins you hold. What it touches is whether an application built on Ethereum still behaves the way it does now once the upgrade lands, because some of those applications were written on the assumption that certain costs would never change. The order of events is the point: the problem was found by auditors, on test networks, before the upgrade went anywhere near real money.

The assumption that stopped the fork

A neat installation of gas meters mounted on an exterior wall in an urban setting.
Gas meters on the outside wall of a building. Ethereum’s own fee unit is also called gas, and the paused fork included changes to how it is charged. Photo by David Brown on Pexels.

Gas is the unit Ethereum uses to meter work. Every operation a contract performs, storing a number, reading one back, sending ether somewhere, costs a set amount of gas, and the user pays for the total at whatever the network is charging that day.

An invariant is something a developer treats as permanently true while writing code. Plenty of contracts carry one about gas: the author worked out that a given operation would never cost more than a certain amount, wrote a fixed budget to cover it, and moved on. That budget has held up for years because the price of the operation stayed put.

EIP-8037 and EIP-8038 move the price. According to ChainSecurity‘s technical write-up, linked from the Foundation’s post, EIP-8037 separates out and increases the cost of creating new state, while EIP-8038 reprices state access and execution. The aim is to charge closer to what operations actually cost the network. The side effect is that a contract carrying a fixed gas budget can suddenly find it too small.

When that happens, the call inside the contract fails. Depending on how the contract was written, that is either a transaction the user retries a minute later or a state the contract cannot get itself out of.

What the Foundation said

The post, published on 6 November by Marius van der Wijden, is short and deliberately unexcited. ChainSecurity found “a few projects” that would be vulnerable after the upgrade. On that basis, the All Core Devs call agreed to delay the hardfork process and not fork the Hoodi test network until the issues are resolved.

The Ethereum Foundation has published eight invariants that Glamsterdam breaks in a public GitHub repository, with explanations, examples and prompts developers can use to check their own code against them. Anyone who finds a problem is asked to email the team directly.

It also explained why that outreach is necessary rather than a courtesy. The Foundation is running internal audits and has engaged several auditing firms, but in its own words it “can not cover all projects on Ethereum, especially not their on and off-chain code.”

Where the evidence stops

That sentence is the real scope of the story. Nobody knows how many contracts are affected, because nobody has looked at all of them. The post does not name the projects ChainSecurity flagged, does not give a count beyond “a few”, and puts no figure on what might be at stake. It does not say the issues have been fixed either. It is a request for people to come forward and check.

One number doing the rounds in community write-ups, thirteen cases where the two proposals interact to turn a recoverable failure into a permanent one, comes from a third-party researcher’s summary rather than from the Foundation or ChainSecurity’s own material. It is worth reading, but it is not part of the official disclosure.

Cointelegraph and The Defiant both covered the same post. The Defiant noted that most of the findings involve fixed gas budgets and reserves, and that the Hoodi upgrade remains paused with no confirmed main network activation date.

What to watch

Whether All Core Devs reschedule the Hoodi fork. That would suggest they think the scope of the problem is understood, rather than being worked through one project at a time. And whether the gas values in EIP-8037 and EIP-8038 are revised, because respecifying the proposals is the other way out of this, and it would change what developers need to look for.

The Foundation’s post is dated 6 November, and the status of the delay may have moved on since.