ChainSecurity's October 13, 2026 research indicates that changed state gas costs can cause a contract to record an underfunded operation as permanently unsuccessful, removing its retry path

Overview Debates Related claims Topics Sources

Vitalik Buterin defined Ethereum's core priorities using the acronym CROPS, standing for censorship and capture resistance, open source, privacy, and security

Vitalik Buterin identified post-quantum security, base-layer ossification, and strict limits on in-protocol rewards as technical requirements for Ether to function as a store of value

The planned October 26, 2026 activation of the Hoodi testnet with a 200 million gas-limit increase was postponed on October 22, 2026 pending resolution of security and gas accounting issues

On November 6, 2026, Ethereum Foundation developer Marius van der Wijden published an appeal asking application developers and auditors to evaluate eight gas invariants and report repair options for affected smart contracts

EIP-8037 raises gas costs for creating persistent state data, causing immutable smart contracts with fixed gas budgets or gas introspection checks to run out of gas and potentially lock user funds permanently

Proposed INV-8 rules for EIP-7702 delegation mean pre-execution gas failures can roll back nonce updates while keeping block inclusion, exposing valid authorizations to front-running and unauthorized contract ownership initialization

Security auditing firm Dedaub is investigating gas-related risks in the proposed Ethereum Glamsterdam upgrade alongside ChainSecurity and internal audits

Under EIP-8037, transactions with gas limits exceeding 16,777,216 fund a separate state-gas reservoir, causing Solidity's gasleft() function to exclude reservoir spending and break transaction relayer reimbursement calculations

The Ethereum Foundation called for smart contract checks after security audits raised concerns regarding Glamsterdam upgrade proposals

An October 13, 2026 ChainSecurity report found EIP-8037 and EIP-8038 break smart contracts when external calls fail, tied to eight smart contract invariants

Ethereum core developers delayed the implementation of the Glamsterdam upgrade on the Hoodi testnet until security concerns involving eight smart contract invariants are resolved

The Ethereum Foundation stated on November 6, 2026 that EIP-8037 and EIP-8038 change how gas is charged for certain operations

Cc9f267dcClaimNews event

The Tempo development team discovered the Reth state-root software bug through automated security testing known as fuzzing

Cc9f267dcClaimNews event

Coinbase-backed layer-2 network Base patched its block builders without impacting users

Cc9f267dcNews eventClaim

Developers merged pull request #28264 containing the upstream software fix into Reth's GitHub code repository

Security firm Blockaid confirmed the Reth state-root calculation flaw was a code calculation error rather than an active exploit, with no stolen funds reported

Reth's block-building software used vulnerable calculation code across networks built with Optimism's OP Stack, creating shared defect risks across multiple interconnected Ethereum layer-2 blockchains

Cross-chain messaging protocol LayerZero temporarily paused select transfer routes as a precautionary measure while developers evaluated operational risks related to the Reth state-root software defect

Frax Finance reported on November 5, 2026, that its smart contracts and user assets remained secure despite LayerZero's temporary cross-chain route suspensions

Georgios Konstantopoulos, chief technology officer at Paradigm, said a flaw in execution client Reth's legacy state-root calculation system could return incorrect cryptographic hashes when processing specific smart contract storage configurations