Ethereum delays Glamsterdam hard fork after gas-rework audit flags broken invariants

Ethereum's core developers have put the Glamsterdam hard fork on hold after security auditors found live projects that would break once the upgrade changes how gas is charged, the Ethereum Foundation said in a November 6 blog post.

The specific triggers are two proposals, EIP-8037 and EIP-8038, which, per the Foundation, "rework how much gas is charged for certain operations and how gas is charged for state." In the weeks before the post, the audit firm ChainSecurity identified "a few projects" that would be vulnerable after Glamsterdam because they depend on gas-related assumptions — eight invariants in total — that the two EIPs break. On the strength of those findings, the All Core Developers (ACD) process decided to delay the fork and, specifically, not to fork the Hoodi testnet until the issues are resolved.

The Foundation was candid about the limits of its own coverage. It said it is "engaging multiple auditing companies, as well as doing internal audits," but added that it "can not cover all projects on Ethereum, especially not their on and off-chain code." To close that gap it issued what it called "a call for action" to contract developers and auditors, pointing to a public repository listing the eight invariants Glamsterdam will break, with explanations, examples, and prompts teams can use to test their own code. Projects that find they are affected are asked to email glamsterdam@ethereum.org.

The Foundation did not name the affected projects, did not quantify funds or contracts at risk, and did not give a revised date for the fork. Technical specifics of the invariants sit in a separate ChainSecurity blog post and tool referenced but not reproduced in the announcement.

Key facts

• Glamsterdam hard fork delayed; Hoodi testnet will not be forked until the flagged issues are resolved — Ethereum Foundation blog, Nov 6, 2026.
• Cause: EIP-8037 and EIP-8038, which rework gas charging for certain operations and for state — Ethereum Foundation.
• Auditor ChainSecurity found "a few projects" vulnerable post-upgrade, tied to eight gas-related invariants — Ethereum Foundation, citing ChainSecurity.
• Foundation published a repository of the eight broken invariants and a contact address (glamsterdam@ethereum.org) for affected teams — Ethereum Foundation.

The real-world read

This is a disclosure, not a marketing post — and it reads like one: the Foundation is explicit that its audits "can not cover all projects," which is an unusual admission and the reason for the public call for action. The vagueness is the story. "A few projects" is undefined; there's no count of affected contracts, no value-at-risk, and no new fork timeline. The underlying technical claims — what the eight invariants are, how severe the breakage is — rest on ChainSecurity's separate post and tool, which the announcement cites but does not detail, so they can't be independently assessed from the announcement alone. Delaying a testnet fork over audit findings is a conservative call; whether it's a minor cleanup or a significant redesign of EIP-8037/8038 isn't yet knowable.

Opinion, and whose

The Ethereum Foundation's implied position is that shipping Glamsterdam before these invariants are addressed would be premature — hence the pause and the open request for outside review. No timeline or forecast was offered.

Sources

• Ethereum Foundation blog (primary, Nov 6, 2026) — announcement of the delay, the role of EIP-8037/8038, the ChainSecurity findings, the eight-invariant repository, and the contact address. Official project communication, not sponsored.
• ChainSecurity (referenced, not reproduced) — cited by the Foundation as the source of the vulnerability findings and the technical detail on the invariants.

This is news coverage, not financial or security advice; developers should consult the referenced materials and their own auditors.