Ethereum developers have indefinitely canceled Glamsterdam's Hoodi activation and deferred its mainnet date after researchers uncovered serious security vulnerabilities affecting existing smart contracts. During ACDE Call #248, developers acknowledged that the upgrade may not reach mainnet until 2027.

The findings involve gas repricing changes introduced by two Glamsterdam proposals, with at least 13 major DeFi projects identified as vulnerable. While developers assess the security implications and coordinate client rollbacks, Hegotá development will continue through another execution-layer devnet, followed by combined testing after Devcon.

Glamsterdam Security Findings Force Upgrade Reassessment

Ethereum developers agreed that Glamsterdam's security impact must be fully assessed before deciding whether to retain, delay, or modify the current upgrade specifications. The decision follows serious vulnerabilities identified by ChainSecurity in EIP-8037 and EIP-8038, which introduce changes to Ethereum's gas accounting and repricing mechanisms.

Researchers demonstrated how previously invalid transactions could exploit contracts relying on that behavior. One scenario involves recovering gas following a reverted operation, allowing contract balance accounting to change without the corresponding ETH transfer.

ChainSecurity reported identifying 13 major DeFi projects with vulnerable contracts, although the investigation was not exhaustive. Responsible disclosure remains underway, and researchers noted difficulties reaching some affected projects through their existing bug bounty channels. The findings extend beyond a single exploit pattern.

Contracts relying on out-of-gas detection or assumptions surrounding the EVM's 1/64 gas retention rule may also behave unexpectedly under the new pricing model. This is particularly significant because the affected proposals had already progressed through Glamsterdam's specification and testing process.

No final mitigation strategy was selected. Security researchers and client representatives are expected to return with a fuller impact analysis and assessment timeline at the next All Core Developers Testing (ACDT) meeting.

The broader concern is application compatibility. Even when protocol changes work correctly across clients, their interaction with assumptions made by deployed smart contracts can create vulnerabilities that conventional network testing does not necessarily expose.

Hoodi Fork Canceled, Mainnet Decision Deferred

Developers canceled Glamsterdam's October 26 Hoodi activation indefinitely and deferred the mainnet scheduling decision until the security investigation is complete. No replacement Hoodi date was announced, while the previously discussed December 2026 mainnet window is now considered highly unlikely.

This reverses the decision taken just two weeks earlier. During ACDE #247, developers had confirmed October 26 at 17:42 UTC for Hoodi following Glamsterdam's successful Sepolia activation. The schedule was subsequently reinforced during ACDC #189.

At that stage, developers were preparing to validate builder participation, client interoperability, and higher execution capacity before selecting a mainnet date. However, the newly disclosed vulnerabilities changed the risk assessment. Proceeding with Hoodi while the application-layer impact remained uncertain would introduce unnecessary operational complexity, particularly when substantial specification changes might still be required.

The cancellation also requires coordinated client action. All Execution Layer and Consensus Layer teams were asked to publish updated releases removing the scheduled Hoodi fork.

Developers estimated that EthPandaOps and participating client teams collectively controlled approximately 73% of Hoodi's stake, making the rollback operationally feasible. The Ethereum Foundation and client teams were also tasked with publishing guidance identifying safe pre-Glamsterdam client versions, with updates as replacement releases become available.

For mainnet, December 1, 8, and 9 had previously been discussed as potential activation dates. Those options are effectively on hold, with 2027 now regarded as the more likely deployment timeframe, although no new date has been formally established.

The change is notable given the progress recorded across earlier calls. ACDC #187 documented improvements following adversarial devnet testing, while ACDC #188 maintained the Sepolia rollout plan. Glamsterdam had already demonstrated meaningful progress in client readiness, but that progress cannot substitute for resolving vulnerabilities affecting applications deployed on Ethereum.

Follow all Ethereum protocol calls and updates here.

Hegotá Gets Another Execution-Only Devnet Before EL-CL Integration

Ethereum developers agreed to launch bogota-devnet-2 during the week of October 27, keeping Hegotá's execution-layer testing separate before combining it with consensus-layer changes. Nethermind, Geth, and ethrex are expected to participate.

The decision follows discussions among Frame Transactions contributors who favored another isolated testing environment before merging the execution and consensus development networks. The new devnet will focus on four proposals:

• EIP-8253 - Bump nonce of zero-nonce storage accounts
• EIP-4758 - Deactivate SELFDESTRUCT
• EIP-8298 - SETCODEFROM Code Reuse Instruction
• EIP-8151 - Account Code Restricted ecRecover

Developers also discussed incorporating the single maximum-fee adjustment for Frame Transactions through EIP PR #12414, provided no objections were raised. The additional execution-only devnet is intended to identify specification and implementation issues before introducing the complexity of combined testing.

Hegotá's first merged Execution Layer and Consensus Layer devnet, hegota-devnet-0, is now targeted for after Devcon, rather than before the conference as previously discussed. That environment is expected to bring execution work together with consensus-layer development, including questions surrounding the interaction between EIP-8141 Frame Transactions and EIP-7805 FOCIL.

The two proposals represent major architectural directions for Hegotá. Frames focuses on native account abstraction, while FOCIL aims to strengthen Ethereum's censorship resistance through transaction inclusion guarantees.

Combining these features requires careful consideration of transaction validation, inclusion requirements, execution behavior, and implementation complexity. Developers plan to discuss the FOCIL and Frames interaction in person during Devcon before moving toward the merged devnet.

Hegotá Adopts Working CFI Priorities Without Guaranteeing Inclusion

Developers adopted Nixo's proposed Hegotá Considered for Inclusion (CFI) priority ordering as a working first version, while clarifying that CFI status does not guarantee an EIP will ship.

The list will remain a living document rather than a binding commitment. The discussion reflects increasing concern over how Ethereum evaluates proposals once they have gained preliminary client support. Participants argued that CFI should represent meaningful consideration, not an informal promise of inclusion.

Several developers favored raising the threshold for CFI and explicitly asking whether Ethereum should adopt a proposal before advancing it to Scheduled for Inclusion (SFI). This distinction matters because Hegotá already contains a substantial collection of potential changes, each competing for limited implementation, testing, and security-review capacity.

Several existing candidates remain under evaluation, including Frame-related companion proposals EIP-8250, EIP-7906, and EIP-8272. Meanwhile, Nethermind revised its assessment of EIP-8304, Trustless Log and Transaction Index, to A priority, arguing that Ethereum should begin making progress toward verifiable RPC infrastructure.

The change is notable because EIP-8304 had previously been declined for Hegotá during ACDE #246. Nethermind's revised position does not reverse that earlier outcome or establish consensus for inclusion, but it signals renewed support for the proposal.

Developers also agreed to extend ACDT meetings from 60 to 90 minutes to accommodate increasingly complex testing and integration discussions. With Devcon approaching, the regular ACDE meeting scheduled during conference week has been canceled. The next execution call is expected around November 19.

Until then, Glamsterdam's security investigation will determine whether its current design can proceed, while Hegotá's testing and prioritization efforts will continue. The decisions reinforce the importance of evaluating protocol changes not only against client implementations and devnet performance, but also against the behavior of contracts already operating across Ethereum's ecosystem.

If you find any issues in this blog or notice any missing information, please feel free to reach out at yash@etherworld.co for clarifications or updates.

If you find any issues in this blog or notice any missing information, please feel free to reach out at yash@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

• Ethereum Protocol Update: ACDE #247
• Ethereum Protocol Update: ACDE #246
• Ethereum Protocol Update: ACDC #189
• Ethereum Protocol Update: ACDC #188
• Ethereum Protocol Update: ACDC #187

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.