Glamsterdam Gas Audit: Ethereum Asks Auditors to Test Eight Broken Invariants

Writing one new storage slot on Ethereum costs 22,100 gas today. Under the schedule bundled into Glamsterdam it will cost 110,020, and the Ethereum Foundation’s protocol team has opened a public repository, last updated on 6 November 2026, asking auditors to hunt that difference through every client contract they have reviewed. The repository lists eight invariants that EIP-8037 and EIP-8038 break, each with the price that changes, the code pattern that fails, and a suggested fix.

These are measured numbers, not projections. The team says the values were taken in EELS, the executable specification Ethereum uses, against the pinned Amsterdam spec. A cold write to a fresh slot becomes 2,100 of access plus 10,000 of write plus 97,920 of state gas. A transfer to an empty address moves from 25,000 to 183,600. Code deposit goes from 200 gas per byte to 1,530. Ethereum is not adjusting a fee by a few percent. It is repricing its scarcest stored resource and telling the audit industry to check the blast radius before the fork ships.

The market read so far is muted. Ether traded at $2,233.56 at 16:41 UTC on 7 November, down 0.91% over seven days and 7.8% below the 5 November print of $2,423.08, according to CoinGecko data, with a market capitalisation near $272.9 billion. Fees are denominated in ether, so a weaker price lowers the dollar bill for the same gas unit. It does not change the multiple, which is the part that breaks contracts.

Why Ethereum Is Repricing State Now

EIP-8037 states the arithmetic that forced the change. In January 2026 the state database inside a Geth node was about 390 GiB. When the block gas limit moved from 30 million to 60 million gas, average new state per day more than tripled, from roughly 105 MiB to 326 MiB, which works out to about 116 GiB a year. The authors treated that post-increase rate as the new baseline rather than a one-off: at a 200 million gas limit the same behaviour extrapolates to roughly 387 GiB of new state a year.

From 390 GiB, that schedule reaches the 650 GiB point where clients begin to degrade in less than a year by the authors’ own description. My arithmetic puts it at about eight months: 260 GiB of headroom divided by 387 GiB a year. That is the entire argument for the repricing, and it explains the urgency behind the audit request. Higher block limits buy throughput on the execution side and pay for it on the storage side, and the second bill arrives later, at disk level.

The instrument is a new constant, CPSB, the cost per state byte, set at 1,530 gas. It is calibrated to hold average growth at 120 GiB a year at a reference block gas limit of 150 million. A storage set is measured at 64 state bytes, so 64 times 1,530 gives the 97,920 state-gas figure above. A new account is 120 bytes, so 183,600. An EIP-7702 authorization base is 23 bytes. Once the unit is defined, the rest of the schedule follows mechanically, which is why the same multiplier appears across operations that previously had nothing in common.

The New Price List, Operation by Operation

The table below reproduces the comparison published in the repository, measured on the pinned Amsterdam spec. State gas is charged through a separate meter, so the totals are not simply added to a single gas pool.

EIP-8038 handles the access side and splits costs that the old schedule fused into composite constants. Storage write climbs from 2,800 to 10,000, an increase of 257%. Account write goes from 6,700 to 9,000, up 34%. The create access component moves from 7,000 to 12,000, up 71%. The storage clear refund rises from 4,800 to 11,616, up 142%. Cold account access goes from 2,600 to 3,000. Cold storage access stays at 2,100 and warm access stays at 100, so the change is aimed at the expensive paths rather than at every read.

Both proposals carry Last Call status. The review deadline shown on both is 1 November 2026, which has already passed, and EIP-8037 was first created on 1 October 2025. A passed deadline makes the text eligible for finalisation. It does not freeze it, and the repository says so directly.

Eight Assumptions the EVM Can No Longer Make

The foundation separates the failures into two families. Price invariants break because a number changed. Accounting invariants break because EIP-8037 meters state gas differently, through a reservoir that only exists above a gas threshold. All eight are listed, because a summary that keeps three of them is worse than useless to an auditor.

INV-1, accounting. The old assumption was that a call running out of gas fails the whole transaction. With a reservoir in place, code that runs after a failed call can still write storage, and the transaction finishes while recording the failure. A call with an explicit gas cap no longer limits how much state gas the callee can spend on writes. The red flag is a failed call followed by a permanent “done” marker, and the fix is to let failed items be retried or to revert when the call received too little gas.

INV-2, accounting. Deleting a value that was set earlier in the same transaction used to give no refund until the end. Now a slot set from zero and cleared inside one transaction returns its 97,920 of state gas immediately. Locks and flags toggled around an external call change both cost and ordering. Transient storage, or a non-zero resting value, avoids the problem.

INV-3, accounting. Gas spent by a reverting call used to be gone. Now a reverting call hands back the storage gas it used, so the caller ends with more gas than expected, and a failed contract creation returns 183,600. Code that infers “out of gas” from empty revert data, or from the remaining gas, now infers wrong. Check the CREATE result instead of guessing why a call failed.

INV-4, price. A fixed gas amount used to be enough. Creating storage, accounts and contracts now costs five to eight times more, and updating existing storage adds about 7,200 per write. Hard-coded limits live in contracts, their configuration, signed messages, bots and relayers, and the failure mode is a first-time recipient: a new token balance or a previously unseen address. Gas limits should be adjustable and estimated under the new rules with a margin.

INV-5, accounting. Gas left used to fall monotonically, so the difference between two readings was the work performed. Gas left can now rise during a call, and state gas paid from the reservoir never appears in it. Subtracting two gasleft() readings can produce a negative number, which reverts under checked arithmetic and wraps under unchecked arithmetic. Do not bill or refund from that difference; charge an agreed fee, or clamp and cap the measurement.

INV-6, price. After a call ran out of gas, the retained 1/64 used to be too little to accomplish anything. At the new prices that leftover can be enough to finish and record a failure. Calling without a gas check and then marking an item processed is no longer safe, and gas estimation can land inside that range.

INV-7, price. Reserves and stipends sized for the old schedule no longer cover the work. The 2,300 stipend attached to transfer and send cannot create a storage slot. Contracts that receive value through those opcodes and then write storage will fail, and a nonce consumed before a call that can fail compounds it.

INV-8, accounting. A 7702 delegation inside a mined transaction used to mean the delegation had been applied and could not be reused. A delegation that runs out of gas is now rolled back while its transaction is still mined, so anyone can reuse the signed delegation. Wallet setup and initialise functions that anyone can call are the exposed pattern. Tie setup to the signature and check the account code after the transaction.

What a 24 kB Deployment Costs Under the New Schedule

EIP-8037 publishes one headline case: a 24 kB contract deployment moving from 4,947,200 gas to 37,784,880, which the proposal rounds to about eight times. The working is not shown, so here it is. At 24,576 bytes and 1,530 gas per byte, the code deposit alone is 37,601,280 state gas. Add the 183,600 charge for the new account that the deployment creates and the total is 37,784,880, exactly the figure in the proposal. The implied multiplier is 7.64.

Block space tells the operational side of the story. Against today’s 60 million gas block limit, the deployment used 8.25% of a block and will use 62.97% of one. At a base fee of 0.08 gwei, the average the proposal cites from the period after the 60 million increase, the dollar cost moves from about $0.88 to about $6.75 at an ether price of $2,233.56. At 20 gwei the same deployment moves from roughly $221 to $1,688. The gas is cheap this week. The block is not.

Who Pays, and Who the Documents Exempt

Layer 2 networks are outside the scope. EIP-8037 states that existing networks, including mainnet and the L2s, keep their own gas schedules, so rollups are not inheriting this repricing through the fork. The exemption has a narrow exception: networks that activate the EIP from genesis, such as new devnets and testnets, must either regenerate the pre-signed deployment transactions for deterministic factories or pre-deploy those factories at genesis. SingletonFactory, Create2Deployer, ImmutableCreate2Factory and CreateX are named.

Inside mainnet, the cost lands on anyone who creates new state. Every fresh exchange deposit address costs 183,600 state gas the first time it receives ether, against a 21,000 gas transfer, and the proposal acknowledges the incentive that creates: send a plain transfer first to bring the account into existence and skip the charge. EIP-2780 is the proposed fix, adding the new-account charge to intrinsic gas so the trick stops paying. Wallets that generate addresses in bulk, custodians, payment processors and airdrop distributors all sit on that line.

The operational layer carries INV-7 in particular. Relayers, arbitrage bots, liquidation keepers and meta-transaction services embed gas reserves and stipends in signed payloads and configuration. Those numbers were sized for a schedule where a storage write cost 2,900 warm. At 10,100 the same reserve no longer covers the work, and the failure appears as a reverted or, worse, a partially completed transaction.

The Reservoir Threshold Clients Have to Size For

The accounting changes hinge on one number: 2^24, or 16,777,216 gas. Above that transaction gas limit, state gas is metered through a separate reservoir. Below it, all state gas comes out of gasleft() and behaviour looks closer to today. That single threshold decides which of the four accounting invariants even apply to a given transaction, which is why the repository pairs every accounting invariant with the phrase “with a reservoir”.

Two more parameters bound the same design. A single call may perform at most 16 system storage writes, and the maximum total transaction gas limit is 2^32 minus 1. For builders, the proposal is candid about the trade-off: block construction now balances several resource dimensions instead of one gas number, and sophisticated builders may gain an edge, though greedy heuristics keep construction feasible for smaller operators.

What Is Not Decided Yet

The repository closes with a sentence that matters more than any of the gas figures: “We are trying to collect feedback in order to have a well-founded discussion on the next ACD about the impact of changing these invariants.” It adds that, depending on the response, the team might “slightly change EIP-8037/8038 or not”. No mainnet activation date appears in either proposal or in the repository, and the block gas limit increase that Glamsterdam was expected to carry depends on the same decision.

The timeline in the repository is short. An initial commit landed on 1 November 2026, the contact route was added on 2 November, the state-gas credit rules were tightened on 4 and 5 November, and the last merge is dated 6 November. None of those commits announces an activation date.

Ethereum has already been here once this cycle. The block limit is coupled to client readiness, which is why Prysm shipped a last-minute fix for the 200 million gas limit before the Glamsterdam test, and why the earlier Glamsterdam testing phase put ePBS and access lists in the same delivery. Repricing state is the precondition for raising the limit, not an independent change.

Most reported findings reference INV-4 and INV-7, the two price invariants that hit hard-coded gas numbers, so those are where the audit effort is concentrated. The team asks for reports by email rather than in public issues: “Please report by email, not in a public issue, so that problems can be fixed before they are widely known.” It also asks for a working exploit where one exists, which is an unusual request to see in public and a fair signal of how seriously the breakage is being treated.

For readers holding ether rather than auditing contracts, the transmission channel is indirect and slow. A repricing that raises the cost of creating accounts and slots shrinks the set of applications that can pay for new state, and it changes which designs remain viable on mainnet versus on a rollup. That is a fee-market story with a multi-quarter horizon, not a reason for a same-day price move, and nothing in the published documents ties the repricing to ether’s recent decline.

Frequently Asked Questions

Disclosure: this article cites the Ethereum Foundation’s public repository and the two Ethereum Improvement Proposals it references. Gas figures are the values published in those documents, measured in EELS on the pinned Amsterdam spec, and may change if the specification changes.