On October 22, 2025, Ethereum's DevOps team edited a configuration file. That is the whole event. Four days before Hoodi was scheduled to activate at epoch 132,352, the fork was unscheduled โ removed from the shared config, not patched, not deferred by a vote, not announced with a blog post about community consensus. A diff in a YAML file.
I have been on the other side of that diff. In 2018 I spent six weeks modeling edge cases in the 0x exchange contract logic and filed a report that forced a deployment halt. The team was unhappy. The halt was correct. What I did not have then โ and what ChainSecurity had here โ was a finding that did not correspond to any line of code being wrong.
That is the part the market is missing. Hoodi was not cancelled because of a vulnerability. It was cancelled because the protocol was about to change the meaning of code that nobody intended to touch.
Glamsterdam โ execution layer Amsterdam, consensus layer Gloas โ is the most structurally ambitious fork package Ethereum has attempted since the Merge. Three components matter. EIP-7732, enshrined Proposer-Builder Separation, writes the proposer/builder split into the protocol itself and reduces trust in relays. EIP-7928, block-level access lists, pre-declares the state a block will touch, enabling parallel execution and more predictable gas accounting. EIP-8037 and 8038, the state creation and state access repricing proposals, change what it costs to write to and read from Ethereum's state.
The first two are architecture. The third is accounting. Architecture gets the conference talks. Accounting gets the post-mortem.
State repricing exists for a reason that has nothing to do with this incident. Ethereum's state has grown for years without a mechanism to price its persistence, and 8037/8038 are the first serious attempt to charge for it. That is overdue and correct in principle. The problem was never the direction of the change. It was that the change shipped inside a package carrying two architectural rewrites and a tenfold gas limit increase, with no behavioral compatibility model attached.
Sepolia activated the package on October 6. Hoodi was the last public dress rehearsal before mainnet, with candidate dates in December โ the 1st, the 8th, the 9th were all on the table. ChainSecurity published on October 13. Nine days later the entire package came out of the shared configuration. And when the Besu team rolled back, it removed something else along with it: the plan to lift Hoodi's gas limit to 200 million, roughly an order of magnitude above Ethereum's current ceiling.
That second detail is the one I would underline twice.
Worth noting how the cancellation was executed. Not a code revert. A shared configuration file, edited centrally, with each client expected to follow. That is the fastest rollback mechanism Ethereum has and also the most brittle: it depends on every operator re-reading a config they already applied.
ChainSecurity's warning was not a reentrancy bug or an integer overflow. It was this: under the repriced schedule, operations that previously reverted could now complete. Retryable operations could become permanent failures. Same bytecode. Same storage layout. Same everything a block explorer shows you. A different execution outcome.
For anyone who has spent time inside the EVM, the mechanism is not mysterious. transfer() and send() forward a fixed 2,300-gas stipend, and a generation of contracts used that stipend as a poor man's reentrancy guard โ the receiving fallback simply could not do much with 2,300 gas. The 63/64 rule caps forwarded gas at 63/64 of what remains, which makes the boundary between success and failure a function of the caller's remaining gas rather than the callee's intent. Contracts that implemented soft reentrancy protection by deliberately exhausting gas โ accept the call, let it run out, catch the failure โ built their safety model on a gas schedule the protocol was about to rewrite.
None of these patterns are wrong. They were correct for a decade. They were correct because "the code does not change" was treated as an invariant.
It was never an invariant. It was an assumption with an excellent track record.
The 200 million gas limit is not a neutral throughput knob. Reverting a call is cheap. Completing one is not. If a contract's guard relies on running out of gas, raising the ceiling from tens of millions to 200 million converts a class of failed calls into expensive successful ones โ and successful execution of a path that only ever existed in its failure mode.
Besu removed the ceiling change in the same rollback. Correct call, and an admission: the two changes were never independently safe. A gas limit increase is a multiplier on every semantic change shipped beside it.
Sepolia went live October 6. The disclosure landed October 13. Seven days of live execution against a repriced gas schedule on a public testnet, with nobody specifically instrumented to watch for semantic drift. I am not claiming there was breakage. I am claiming that a clean bill of health from an unwatched testnet is not evidence of anything.
This is a pattern I know from the Nansen work. In 2021 I traced wallet clusters for three weeks and found that 85% of the volume in top collections was self-custodied wash trading. The floor price chart said liquidity. The wallet graph said theater. The metric was manufactured and every downstream participant priced it as real. Testnet "it ran fine" belongs to the same class: it measures that blocks were produced, not that semantics held.
Besu merged the unschedule PR. Merged is not deployed. Nodes running Besu 26.10.0 that do not upgrade will still activate Amsterdam at the timestamp. A multi-client architecture propagates decisions at the speed of operator diligence, not at the speed of a merge. Hoodi could fork โ benignly, on a testnet, but fork โ because a merged pull request is a signal, not a state change.
In the CCIP review I ran in 2024, the finding was not that the routing mechanism was broken. It was that the mechanism had been added quickly and the failure mode was reachable. The team patched it. The lesson I kept: in critical infrastructure the risk surface grows faster than the review surface, and the gap always opens in the boring part โ configuration, deployment, upgrade paths. The cryptography is usually fine. The YAML is not.
Ethereum's security narrative rests on contract immutability โ the code is law, nobody can change it, not even Vitalik. That narrative is true at the bytecode layer and false at the semantics layer. Protocol-level gas parameters are hidden mutable state. They are admin keys that nobody calls admin keys because they live in a spec document instead of an onlyOwner modifier.
And when they change and break something, there is no counterparty. Rough consensus has no legal personality. There is no entity to serve, no liability to assign, no forum to file in. This is the same structural hole I have written about in DAO governance for years: an organization with no legal status, where the people who acted carry unlimited personal exposure and the people who decided carry nothing. Here the deciders are a handful of client teams and researchers; their downside is reputational. The downstream DeFi protocol liquidated by a semantic shift has no recourse but a post-mortem.
Meanwhile the compliance budget flows toward KYC screens that three wallet hops defeat. Institutional risk officers will request an attestation about a counterparty's AML program and will not ask whether the vault contract they are depositing into depends on a 2,300-gas stipend. One of those questions is theater. The other is due diligence. The ledger does not lie; the roadmap does.
One more transmission path matters, and it is the one the rollups are not pricing. Most L2 fee models hardcode an L1 data-availability and execution cost component. Change the L1 gas schedule and every one of those estimators drifts, which means published L2 fee quotes are briefly wrong in a direction nobody has measured. That is a small wound. The larger one is structural: if state access gets more expensive on L1, activity migrates to L2, which raises blob demand, which โ under the post-Dencun fee market โ eventually reprices the very data availability the rollups moved there to escape. Blob space is not infinite and the curve is not gentle. The repricing debate Ethereum is having about L1 state will be had about L2 data inside two years, and the rollups are not modeling it.
The bulls are right about the thing they usually get wrong. Pulling a fork four days out, with three mainnet dates already socialized, is not dysfunction. It is the most expensive quality signal this network produces. Solana would have shipped it โ not a criticism of Solana, a statement about what each chain optimizes for. Ethereum just paid a real narrative price: the Glamsterdam catalyst is gone for 2025, ePBS slips with the package, and competitors get a fresh "Ethereum is slow" talking point, all to buy down a class of risk it did not know it carried.
But the bulls are drawing the wrong conclusion. The lesson is not "Ethereum is safe." The lesson is that in 2025 the network discovered its gas schedule was a live wire touching every deployed contract on the chain, and that nobody had a compatibility model for it. That is not a success story. It is a near miss, caught by an external audit shop, on schedule, by nine days.
A protocol that depends on a security firm noticing semantic drift two weeks after a testnet activation is not safe. It is lucky, and the luck is load-bearing. Ask what the same finding looks like if ChainSecurity had published on October 27 instead of October 13.
The next sixty days separate a delay from a rewrite. If EIP-8037 and 8038 return with identical parameters and a new date, nothing was learned. If they return with an explicit behavioral compatibility constraint โ a stated commitment about what gas repricing may and may not break โ Ethereum will have converted an incident into an asset, and the audit firms will have a new product line.
Watch three signals: whether Geth, Nethermind and Erigon all ship removal builds; whether anyone reports genuine breakage from the Sepolia window; and whether December's dates disappear quietly without a replacement. Code is law, but capital is king. Hype is leverage in reverse.