Ethereum developers have paused the Hoodi testnet fork of Glamsterdam because they are dealing with audit findings regarding the behavior of applications when the balance for transactions gas is insufficient. This upgrade will change how certain operations that affect or extend the state of the network are billed. The auditors found that even contracts written before the upgrade may behave differently under the new rules.

The key points are as follows:

• Ethereum developers originally planned to conduct a Hoodi fork on October 26th, but then postponed it. A developer update on November 6th indicated that the fork was still on hold while the team worked on addressing the issues raised during the review process.
• Two proposals, EIP-8037 and EIP-8038, will affect the costs of creating states and accessing existing states. This change may alter the remaining quantity of gas when the contract executes to a certain node.
• ChainSecurity has found that in some cases, a call may fail, but the contract that initiated that call can still complete its failure handling logic. Under the previous gas rule, the same path might lead to the rollback of the outer transaction.
• Developers are verifying the assumptions made in the implementations of various clients and in the existing contracts. According to updates from the Ethereum Foundation, ChainSecurity, Dedaub, as well as internal reviewers, have all participated in the review process.
• The work on Hegota is still progressing in parallel. Next, for Glamsterdam, we need to focus on the revised test network schedule and the results of the tests conducted behind it.

Ethereum developers were originally scheduled to conduct a fork test on Hoodi on October 26th, but this arrangement was postponed. On November 6th, Ethereum Foundation developers Marius, van, der, and Wijden indicated that the fork was still on hold during the time developers were addressing issues discovered during the review of gas.

The core of the dispute lies in a detail that most people only encounter when a transaction fails. A contract can call other contracts and decide how to handle situations where these calls return failures. Even though this code may look exactly the same after an upgrade, due to the different ways the network now charges for certain operations, it could still lead to different outcomes.

This is also why an upgrade aimed at adjusting the way Ethereum's state is accounted for has become a problem for both application developers and the teams responsible for writing Ethereum clients. Both parties need to know which old assumptions will still hold true after this change.

Changes from Glamsterdam to gas

EIP-8037 has changed the way the protocol accounts for operations related to state creation. Ethereum's state includes records such as contract storage. State changes persist across transactions, and therefore their costs affect the nodes that need to maintain the chain even after the original transaction has concluded. This proposal separates the accounting for some state creations from regular executions of gas and establishes an independent reserve that can be called by eligible operations.

EIP-8038 involves the operation of re-pricing access status. These two proposals affect different parts of the execution path. A contract may first read a value, then initiate an external call, and finally write the result. If only the proposed price written at the end is reviewed, ignoring the impact of the previous reads and calls on the budget available at that point in execution, problems will be overlooked.

Therefore, even if users enter the same transaction parameters, a familiar application may produce different results. The key question is: which of these differences reflect the expected repricing, and which expose the assumptions on which the client or contract relies.

How a single failed call can change the final outcome

Imagine a contract calling another contract to perform a step within a larger operation. If the second contract fails, the caller can choose to abort the entire operation, or they can handle the failure and continue executing. Batch processors might record a single failure and then proceed to the next item; another type of application might expect that as long as the failed call consumes enough gas, the entire operation should be rolled back.

The analysis described in ChainSecurity explains how the new accounting method affects this distinction. Ethereum has already restricted through the EIP-150 rule how many gass the caller can forward. In such cases, approximately one sixty-fourth remains in the hands of the caller. The question is, how much of the gas can the caller actually use after execution returns, and what is the cost required to complete the instructions along that path.

Assume that a certain application treats a call failure as a normal business outcome. If it has sufficient gas to complete the failure handling logic, it may record the result or continue to execute the remaining parts of the transaction; if gas is exhausted during this process, the outer transaction will be rolled back. These two outcomes will leave different records, even though the inner call failed in both cases.

The auditor also checked the judgments based on gasleft (). The contract can use this instruction to compare the remaining execution budget with a hardcoded minimum value. A threshold that is calibrated under one billing arrangement may no longer be a reliable prediction under another arrangement, especially when the contract encounters state operations or forwards gas to other addresses. The contract is unable to automatically correct the values embedded by the developer during deployment.

What does the auditor need to confirm?

The November update from the foundation described eight assumptions that are currently under review. The testing involves at least two different issues. Clients that implement the new rules must arrive at the same result for the same transaction; reviewers applying these rules must also identify the situations in which this common result differs from what is expected by the existing contracts.

For the first issue's testing, it is possible to execute the same transaction on multiple clients and compare the status with the result of gas. For the second issue's testing, however, it is necessary to follow the application's own logic for tracking. The key points are whether the contract regards a failed callback as a signal to continue execution, whether it records the state changes before making the call, and whether it can distinguish between business rejections and calls that were not able to be completed due to insufficient gas.

These paths are easily overlooked in routine deployment testing. A typical transaction budget may be sufficient to allow the call and its processing logic to pass successfully under both sets of rules. However, a deliberately tightened budget may reveal differences. Therefore, boundary testing must include failed calls, as well as scenarios that are close to reaching or completing the required amount of gas for failing processing logic.

What can Hoodi display?

Glamsterdam Previously, they had entered the Sepolia testnet of Ethereum, where developers tested the upper limit of 200 million gas. Hoodi will provide developers with another shared deployment environment for further verification of the revised upgrade.

The public test network fork provides a common environment for the client teams and application operators to run these checks. Operators can update the clients according to a shared schedule, compare the results, and test tools against the fork rules. Application teams can then check whether the transaction simulations and gas estimates reflect the same changes observed during the execution process.

If the Hoodi fork is successful, developers will be able to obtain evidence regarding the tested version and transactions. A longer-term question is how representative applications will perform at the budgetary boundary of gas. It would be easier to assess if the new fork date were announced along with the reproduced cases, the changes made, and the testing methods.

Work related to gas is also being progressed in parallel with other fixes. During the review periods of Hoodi and gas, Ethereum developers separately revised the validator deposit specifications. These fixes require their own testing, as they affect different parts of the fork.

Currently, the latest developer update provides the reasons for the suspension and indicates that the work on Hegota is still ongoing. It does not specify a particular time for the next test under Glamsterdam, but leaves it to be decided later on.

How does the upper limit coordinate with the status cost of gas?

A higher block gas limit means that Ethereum can support more transactions within its accounting system. The price assigned to a single operation determines how much of this "space" is occupied by that operation. Therefore, changes in the limit and changes in price may affect different parts of the same transaction.

Some tasks will end at the conclusion of a transaction. However, the creation state is different, as data can continue to exist afterward, leaving content that still needs to be stored and processed for the node operators. Even if there is little traffic after the application that created that state is no longer in use, a new storage slot, account, or contract will add to this burden.

EIP-8037 has changed the cost accounting method for certain state creations. EIP-8038 has re-priced access to states, which may include operations involving existing records. A single transaction that first reads a value, then calls another contract, and finally creates a storage entry, might encounter both of these changes in a single execution.

Simply increasing the block limit does not indicate whether the cost of this path will be higher or lower. The block limit describes the available space for the entire block; it is the transaction path and the price of each operation that determine whether it can fit within what the sender provides, which is gas.

This point was already very important when starting to test with a limit of 200 million gas at Sepolia. That test demonstrated the content running on that network by the developers. The pause of Hoodi was in response to the question: Are these rules ready to move onto the next testing network, and how will applications that rely on the old gas assumptions perform?

Eight assumptions under review

The Ethereum Foundation’s audit repository categorizes examples into two types: one is related to changes in operating prices, and the other is related to changes in the gas tracking method. The numbers in the repository come from a fixed version of the proposed specifications; if the proposals are revised, these numbers may also change.

The first type of issue involves fixed quotas and the cost of completing work after a call. Developers may have set a limit of gas for a certain operation, but the current cost of that operation is higher than before. The reserves originally intended to cover the last write may no longer be sufficient. In another case, the small portion of gas retained by the caller might be enough to handle the failure paths that the application was originally expected to roll back from.

These accounting changes also bring about other possibilities. If a separate reserve can still provide funding for creating eligible states, then even if the regular budget is tight, the caller may still be able to record a transaction after a failed call. In such cases, the final outcome for the caller may depend on which operations used that separate budget.

In the same transaction, clearing previously created slots can immediately return a portion of state and gas according to the reviewed specifications. A single rollback call may also return state and gas. Therefore, code that assumes "all gas consumed before the rollback will disappear" might misinterpret what actually occurred.

A single pair of gasleft measurements may not be able to fully reflect the cost of work. If a contract is billed or refunds are calculated based on the difference between two readings, it relies on assumptions about the changes in gas between those two readings. Fees from separate pools, as well as the state and gas returned during execution, can both alter this relationship.

The eighth scenario involves EIP-7702, which allows an account to authorize delegations to contract code. Even if the authorization in a transaction does not take effect due to insufficient gas, the transaction may still be packaged into a block. If a wallet or service assumes that the delegation has taken effect merely because the transaction is included in a block, it could mistake an unfinished action for a completed one.

The repository indicates that many of the findings received by the author are related to fixed amounts or reserves. It requires developers and auditors to test their own applications using these examples and report any issues. The list identifies patterns that need to be reviewed, and it does not mean that every application that uses these patterns will result in losses.

How a single failed call can still result in a successful transaction

Ethereum transactions can contain multiple calls. A contract can request another contract to execute a certain step, and then decide how to respond based on the result. The failure of an inner call is not the same as the failure of the entire transaction.

A batch processing program is a useful example. If one item fails, the processor may record that failure and proceed to the next item; however, if it runs out of gas before recording the result, the outer transaction may be rolled back, and previous changes will be undone. Therefore, the final state can vary depending on what the caller can do subsequently in response to the same internal failure.

Another type of application might consider a call failure as a reason to change who can submit requests or whether a request is allowed to be retried. If the caller is able to complete a path that the application originally expected to roll back, then the result status may be retained. The security impact depends on what is actually recorded along this completed path.

A participant may choose how much gas to provide in a transaction. If this person can ensure that there is enough gas for the outer contract to enter a certain path, but not enough for the inner call to complete, then a failure can be induced through the transaction budget. Contracts that respond to failures need to distinguish between this situation and the case where "the call actually reaches the called party and fails genuinely."

The forwarding restrictions for EIP-150 are part of these rules. When the caller forwards gas according to these rules, approximately one sixty-fourth of it will be retained under relevant circumstances. The retained gas still requires payment for subsequent instructions. Whether these instructions can be completed depends on the billing arrangements and the applicable accounting methods.

The contract may only be sensitive to a small portion of the gas budget. Providing enough gas for the inner calls will ensure it works normally; however, if too little gas is allocated for the entire transaction, the outer path will roll back. The problem lies in the scenario where the inner call fails, but the caller still has sufficient gas to execute actions that the developer did not intend to occur in the event of a failure.

Why changing a fixed gas number may not necessarily solve the problem

Hard-coding thresholds allows contracts to simply check whether they have sufficient gas before initiating a call. Developers may have tested this threshold with common transactions and left a buffer for subsequent work. As a result, this number has become a dependency of the scheduling arrangements that were in place when it was chosen initially.

The cost of a certain operation may also vary depending on whether the application is updating an existing record or creating a new one. Transferring funds to someone who already has a balance may follow a different storage path, whereas transferring to someone who is receiving a balance for the first time may trigger a more expensive process. Testing only scenarios involving duplicate recipients could result in overlooking that more costly path.

The timing of measuring the contract gas is also very important. A read immediately before a call is not the same as a read after several state accesses and the call itself. If the contract infers the reason for failure based on the latter read, it is actually assuming that it understands what may have been charged or refunded in between.

Adjusting the subsidy amount itself can also have consequences. It may allow previously unsuccessful approaches to be completed, or it may provide sufficient gas for the called party to carry out tasks that could not be accomplished under the old amount. Before making any adjustments, developers need to first understand what this amount was intended to prevent in the first place.

Some contracts can be modified through governance or management processes; others are immutable, or rely on components that cannot be changed in place. Even if the contracts themselves can be modified, services that estimate, sponsor, or forward their transactions may also need to update their assumptions.

What does a convincing reproduction need to demonstrate?

Tests can be initiated from the same transaction, the same status, and the same gas limit, and run under both the old rules and the proposed rules. The comparison of results should be able to identify which calls failed, what the caller did subsequently, and whether the transaction recorded changes that would not have been persisted before.

Testing budgets above and below the threshold can help determine whether this effect is limited to a very narrow range. It can also assist in identifying where the execution starts to diverge. Earlier balance checks, the quantity of gas passed to the called party, and the writing operations within the failure handling logic are all potential points where changes may become apparent.

The reviewer then asked: Who can follow this path? Reproducing a certain change in a test contract can only prove that there are differences in execution. In real applications, additional authorization, extra condition checks, or the ability to retry affected operations may be required. These details determine whether someone can forcibly produce unwanted results.

The client team also has another independent test. All clients, under the same fork configuration, should produce the same result for the same transaction. Disagreements between clients represent a different type of issue; however, if all clients consistently produce results that are not anticipated by the application, that is a different problem.

The test suite requires both successful and failed paths. Forcing a rollback after each failed call may prevent certain unwanted state changes, but it could also deprive the batch process of the ability to continue completing the remaining parts. What behavior should ultimately be retained depends on the expectations of the application.

A good reproduction should make it easy to check the final state. If the failure records remain after one run but disappear after another run, the test can show the precise differences, rather than just providing a general report regarding the use of gas. This makes it easier to assess risks and proposed modifications.

What can be added after the public test network is reproduced locally?

Developers can test edge cases in a local fork or controlled client environment. Subsequently, the public test network allows multiple operators to run the same upgrades under shared conditions and compare their behaviors. This also provides teams responsible for wallets and infrastructure with a place to test their own software against the current rules.

Sepolia and Hoodi undertake different steps in this process. The activation of Sepolia indicates that developers can run the planned code on that network and check its performance within the configured limits set by gas. Hoodi provides them with further deployment options after important findings are made during the review process.

Applications, traffic, and historical status on the test network differ from those on the mainnet. A successful fork can provide evidence for client consistency and regular transactions, but it may not cover all contract patterns that users rely on. Targeted reproductions can provide evidence for certain edge cases, which may not exist in the normal test network traffic.

The upgrade instructions are also part of the testing process. The operators need a version that implements the target configuration, as well as a precise activation point; the application, on the other hand, needs to know when to start using the revised rules for simulation. The new date only makes sense in conjunction with these details.

The October extension and the November status report described the same pause from different time points. The former canceled the original Hoodi date, while the latter explained that the issues still needed to be resolved. The next deployment notice will then show which changes are ready for the operators to test.

How to report success when an action fails in a wallet

Wallets usually first estimate gas, and then ask the user to sign. This estimation depends on the state and rules applied by the nodes in the simulation. If the service is using an older fork configuration, the estimation provided may no longer be applicable to the transactions actually executed on the current chain.

A single rollback transaction may still require the sender to pay gas. An outer transaction that continues to execute after a failure within an inner capture might be even more difficult to explain. The blockchain can record the entire transaction as successful, but in reality, one of the actions did not occur. Wallets may need to rely on application events or states to explain this discrepancy to users.

Forwarders and transaction sponsors also face similar issues. They may choose budgets or bear costs for transactions requested by others. If the budget is no longer sufficient to cover the expected path, sponsors may have to foot the bill for the execution of actions that fail to be delivered.

The indexer will observe this impact after execution. A failure path that can now be completed may result in logs or state changes that downstream systems were not previously aware of. The indexer still follows the true state on the chain; applications that rely on the indexer may need to change their interpretation of the resulting records.

End-to-end testing allows for a comparison of wallet estimates, the budget submitted by the sender, the results executed by the client, and the interface's explanation of those results. Each step may be successful on its own, but users may still receive misleading information about which actions were actually effective. This distinction is particularly important when the application considers a certain result as the final outcome.

What can lift the suspension of Hoodi?

The foundation is requesting that the development teams identify the assumptions they are making and provide cases that developers can reproduce. Some issues may be resolved by modifying the proposed gas rules; others may require the application or infrastructure providers to adjust their approach to handling the new behavior.

If the specifications change, relevant tests will need to check whether cases that would have resulted in forks in the past can now produce the expected outcomes. If developers retain certain behavioral changes, the application team will need detailed information to determine whether their software is dependent on the old results. Both outcomes depend on descriptions of the affected calls and the states retained after those calls.

The revised specifications must also be incorporated into the actual client build versions used by the operators. Build versions that support the earlier Glamsterdam configuration may not include subsequent changes. The release numbers indicated in the new Hoodi notifications will specify which versions can be tested together.

The foundation's update in November stated that the work on Hegota is still progressing in parallel. This means that the pause on earlier forks does not cover all development decisions for the next fork. For Glamsterdam, the next relevant milestone will be the revised schedule for Hoodi, as well as the configuration that developers are preparing to make publicly available.

If the fork is successful, the team will have a record that can be reviewed together before the mainnet decision is made. Those cases that caused delays are still the clearest tests to determine whether the revision rules are ready. These tests must demonstrate what happens when a call fails near the gas upper limit, while there is still work to be done on the outer transactions.

How the proposed gas numbers reveal different paths

The foundation’s repository provides a concrete example of the difference between creation status and update status. Under its fixed Glamsterdam specification, creating a new slot involves a cold write that is split into an execution cost and a significantly higher status fee. Writing to an existing slot also requires a re-pricing, but the calculation method is different.

This difference can occur between two users who seem to have initiated the same application request. One user may have used the service before, so the contract updates an existing entry; another user may need to create a new record. The quota gas that is valid for the former may not be sufficient for the latter.

The repository also pointed out that in the configurations they tested, the reserve is only available when a certain specified transaction gas limit is exceeded. For smaller transactions, the status cost comes from the regular budget. Therefore, it is very important to test with multiple budgets and not assume that this reserve will function in the same way for each call.

Therefore, in some cases, when reading the remaining code of gas, only a part of the transaction resources can be seen. However, this data is still meaningful for the budget exposed by that instruction. What changes is that applications can make inferences based on this regarding the total resources that have been consumed or are still available.

These gas examples are bound to the proposed configuration and cannot be directly applied as a unified multiplier to the existing estimates of the wallet. Initial storage writes, calls that use fixed subsidies, and failed commissions all need to be checked separately, as they involve different parts of the rules.

This is also why it would be more useful if the revised Hoodi dates could be published together with the list of cases covered by the specification revisions and this release. In this way, the team can rerun tests that match their own applications before reaching a conclusion about the overall stability of the test network.

Focus Points

• Hoodi Schedule: The revised fork date should indicate the client version expected to be in use by the operator and the fork configuration.
• Client consistency: Cross-client testing can show whether the client will obtain the same state and gas results near the new boundaries.
• Contract behavior: The reproduction test should demonstrate when a failed external call still allows the caller to complete the necessary gas, and what information will be recorded by the outer transaction.
• Proposal revision: Changes to EIP-8037 or EIP-8038 will help to illustrate which review findings require modifications at the protocol layer.
• Application tools: Simulations and gas estimation results can show whether wallet and infrastructure providers correctly reflect the fork rules.

Frequently Asked Questions

What is Hoodi?

Hoodi is a test network used by Ethereum to test network upgrades in a shared environment. The intended fork was supposed to apply the Glamsterdam rules there, so that operators and development teams could jointly observe its performance.

Why has the fork been postponed?

Developers are reviewing findings related to the calculation with gas and how existing applications handle failed calls. They are also checking whether the client implementations are consistent with the results under the proposed rules.

Will this pause immediately change the Ethereum mainnet?

The update in November was aimed at the Hoodi test fork, and there was no announcement regarding the activation of the proposed gas rules on the mainnet, nor was a new mainnet date provided.

Can a contract change its behavior without being updated?

Yes. Contract instructions are executed under the scheduling of the network’s gas. If billing changes result in different budgets available for external calls or their failure handling logic, the same instruction may produce different outcomes.

Will a failed call definitely cause the entire transaction to be rolled back?

No. The caller can handle a single unsuccessful external call and continue to execute. Whether the outer transaction is completed depends on the caller's instructions and the remaining gas at the time these instructions are executed.

What is the purpose of reserves?

It provides a budget that is tracked separately under the proposal for operations created in eligible states. Reviewers must consider how this budget interacts with the gas executions that are visible or转发able to the caller.

Why do auditors need to test low gas paths?

Calls with ample budgets may perform similarly under both scheduling methods. However, transactions that approach the execution limit may reveal that a certain processing logic can be completed under one scheduling method, but will roll back under another scheduling method.

Has the work of Hegota stopped?

The foundation's update in November stated that the work on Hegota is still progressing in parallel. This work has its own milestones, while the Hoodi fork of Glamsterdam still depends on the review results of gas.