Ethereum client teams delayed the Glamsterdam Hoodi testnet fork after ChainSecurity flagged edge cases in EIP-8037, buying time for patched releases.
Ethereum client teams postponed the Glamsterdam Hoodi public testnet fork on October 26, 2026, after ChainSecurity published findings on edge-case behavior in EIP-8037, a proposal affecting execution-layer resource metering for certain transaction types. Coordinators said the delay is measured in weeks, not months, but enough to slip milestone dates that developers had pinned to late October.
Hoodi, intended as the final large-scale rehearsal before mainnet Glamsterdam scheduling, was already running shadow nodes when ChainSecurity's report landed. The security firm identified scenarios where malformed bundles could cause disproportionate gas accounting discrepancies between clients, a class of bugs that historically led to consensus splits when left unfixed.
What EIP-8037 aims to solve
EIP-8037 introduces refined metering for transactions that mix blob data with complex execution paths, a pattern increasingly common as rollups post batches and users interact with blob-carrying type-3 transactions. Proponents argued the change would align resource pricing with actual validator load, reducing unexpected block construction delays seen on testnets earlier this year.
Implementation touched multiple clients—Geth, Nethermind, Besu, Erigon, and Reth—because metering logic spans transaction pools and block assembly. ChainSecurity's review focused on boundary conditions where rounding differences between clients could accept or reject blocks differently under adversarial inputs.
Developers emphasized that the issues are not known mainnet exploits today because EIP-8037 is not yet active on mainnet, but testnet forks exist precisely to surface such mismatches before they carry real economic weight.
ChainSecurity findings in detail
The October 26 report described two primary fault classes: inconsistent overflow handling when blob base fees interact with priority fee caps, and divergent behavior when transactions near block gas limits include reverted sub-calls that still consume blob gas. Proof-of-concept tests ran on isolated devnets with maliciously crafted bundles.
ChainSecurity rated exploitability on Hoodi as medium under controlled conditions and low on mainnet absent the fork, but recommended halting the public test until patches land. Client teams acknowledged one Geth patch candidate within hours and opened tracking issues for Nethermind and Reth.
Ethereum Foundation protocol support staff scheduled extra All Core Devs discussions for October 27 to agree on unified test vectors. Independent auditors volunteered additional fuzzing hours, echoing collaboration patterns from prior EIP delays that ultimately strengthened releases.
Impact on Glamsterdam timeline
Glamsterdam, the execution-layer upgrade following Prague, includes EIP-8037 among a broader bundle touching verkle tree preparations and gas schedule tweaks. A Hoodi slip does not automatically delay mainnet, but coordinators use Hoodi stability as a gating metric for mainnet fork dates communicated to staking services and exchanges.
Staking pools sent operator notices on October 26 advising nodes to remain on current Hoodi commit hashes until a new fork block is announced. Infrastructure providers said the postponement is preferable to rushing a consensus hazard, citing memories of earlier unplanned testnet resets.
Layer-2 teams building rollups that depend on blob pricing models paused internal simulations tied to EIP-8037 constants, avoiding wasted engineering on parameters that may change. Several rollups publicly committed to retesting within one week of patched client releases.
Developer community response
Social channels mixed frustration with relief: frustration because hackathon demos planned around Hoodi features face rearranged schedules, relief because the issue was caught on testnet. Veteran contributors noted that short delays cost less than emergency mainnet patches.
Academic researchers studying Ethereum economics said accurate metering matters for long-term security budgets; underpriced resources invite denial-of-service vectors against block builders. EIP-8037's intent remains widely supported even as implementation details undergo revision.
Tooling vendors updating block explorers and simulation APIs flagged temporary mismatches between Hoodi explorers and local devnets, urging developers to pin client versions in CI pipelines until canonical test vectors publish.
Path forward
Client leads targeted a revised Hoodi fork window in mid-November contingent on green fuzz results. ChainSecurity will re-review patched builds before coordinators set a new fork block number.
Mainnet Glamsterdam scheduling discussions continue in parallel, with some contributors arguing decoupling EIP-8037 into a follow-up upgrade could preserve other Glamsterdam features on time. No consensus emerged on October 27, leaving decoupling as a fallback rather than a plan.
The October 26 postponement reinforces Ethereum's security-first release culture. Hoodi will return when EIP-8037 behaves identically across clients under adversarial tests—not when calendar marketing prefers.
Industry participants who spoke on the record during the October 26–27 news cycle emphasized that headline numbers rarely capture second-order effects on hiring, vendor selection, and compliance staffing. Teams that treated the development as a one-day story began revisiting procurement timelines, risk disclosures, and customer communications by Tuesday afternoon. Analysts cautioned that early market moves often reverse once operational details filter through specialist newsletters and regulator FAQs. Developers and operators said the practical work starts after the press release: integration tests, policy updates, and tabletop exercises that determine whether the announcement becomes durable infrastructure or forgotten hype. Stakeholders with quarterly reporting obligations noted they would quantify impact more precisely on upcoming earnings calls rather than in instant social threads.
Industry participants who spoke on the record during the October 26–27 news cycle emphasized that headline numbers rarely capture second-order effects on hiring, vendor selection, and compliance staffing. Teams that treated the development as a one-day story began revisiting procurement timelines, risk disclosures, and customer communications by Tuesday afternoon. Analysts cautioned that early market moves often reverse once operational details filter through specialist newsletters and regulator FAQs. Developers and operators said the practical work starts after the press release: integration tests, policy updates, and tabletop exercises that determine whether the announcement becomes durable infrastructure or forgotten hype. Stakeholders with quarterly reporting obligations noted they would quantify impact more precisely on upcoming earnings calls rather than in instant social threads.
Industry participants who spoke on the record during the October 26–27 news cycle emphasized that headline numbers rarely capture second-order effects on hiring, vendor selection, and compliance staffing. Teams that treated the development as a one-day story began revisiting procurement timelines, risk disclosures, and customer communications by Tuesday afternoon. Analysts cautioned that early market moves often reverse once operational details filter through specialist newsletters and regulator FAQs. Developers and operators said the practical work starts after the press release: integration tests, policy updates, and tabletop exercises that determine whether the announcement becomes durable infrastructure or forgotten hype. Stakeholders with quarterly reporting obligations noted they would quantify impact more precisely on upcoming earnings calls rather than in instant social threads.
Industry participants who spoke on the record during the October 26–27 news cycle emphasized that headline numbers rarely capture second-order effects on hiring, vendor selection, and compliance staffing. Teams that treated the development as a one-day story began revisiting procurement timelines, risk disclosures, and customer communications by Tuesday afternoon. Analysts cautioned that early market moves often reverse once operational details filter through specialist newsletters and regulator FAQs. Developers and operators said the practical work starts after the press release: integration tests, policy updates, and tabletop exercises that determine whether the announcement becomes durable infrastructure or forgotten hype. Stakeholders with quarterly reporting obligations noted they would quantify impact more precisely on upcoming earnings calls rather than in instant social threads.
Comments
Loading comments…