Ethereum developers have officially decided to postpone the highly anticipated Glamsterdam hard fork on the Hoodi testnet following the identification of critical, gas-related security risks. These vulnerabilities could significantly impact how existing smart contracts handle failed transactions, introducing potential operational vulnerabilities across the decentralized ecosystem.
The Ethereum Foundation (EF) confirmed the delay, noting that the upgrade—which was originally scheduled to go live on October 26—will be pushed back. The postponement will give core developers and security researchers ample time to thoroughly investigate how several proposed changes interact with smart contracts already deployed on the Ethereum network.
The security concerns first came to light on October 13, when blockchain security firm ChainSecurity published an advisory warning that two specific proposals included in the Glamsterdam upgrade, designated as EIP-8037 and EIP-8038, could inadvertently weaken critical safeguards against a sophisticated attack vector known as "insufficient gas griefing."
This unexpected delay has naturally raised questions and uncertainty regarding the broader mainnet timeline for Glamsterdam. Prior to the discovery, Ethereum developers had been eyeing an early December target for the mainnet release, with formal schedules heavily dependent on the successful deployment and monitoring of the upgrade across testnets like Hoodi.
Gas Changes Could Undermine Existing Smart Contract Safeguards
In its comprehensive technical analysis, ChainSecurity explained that under the modified rules introduced by the upgrade, gas could potentially be returned to a smart contract following an operation’s failure. This unexpected return of gas could allow a contract to continue executing its code path when it otherwise would have immediately halted under the network’s current operational rules. Researchers cautioned that these modifications could directly interfere with pre-existing security checks that rely strictly on tracking how much gas remains available during the lifecycle of a transaction.
In attacks categorized as insufficient gas griefing, a malicious caller deliberately provides an inadequate amount of gas for a legitimate smart contract operation to successfully execute. ChainSecurity warned that the proposed adjustments in the Glamsterdam upgrade could undermine existing safeguards designed to mitigate such threats. By altering how gas is handled and refunded during failures, the upgrade could potentially allow smart contracts to permanently record failed operations as processed, bypassing secondary defense layers.
To illustrate the severity of this issue, the security firm noted that an affected contract could prematurely remove a user’s legitimate claim or outright disable the option to retry a failed action. Consequently, end users could find themselves completely unable to complete an otherwise valid and necessary operation on-chain.
Despite the serious implications, ChainSecurity clarified that the Glamsterdam upgrade would not render all gas-related security checks entirely unreliable. Certain defensive mechanisms may still function as intended, but developers across the ecosystem will need to conduct meticulous code reviews to ensure their existing logic adequately accounts for the new gas mechanics introduced by the hard fork.
The emerging findings rapidly triggered widespread concern among prominent Ethereum contributors and core protocol maintainers. In an October 21 comment shared on GitHub, pseudonymous security researcher pcaversaccio characterized the identified risks as "serious" and formally called for a broader reassessment of the hard fork’s readiness and design parameters.
Adding urgency to the situation, ChainSecurity revealed late last week that its ongoing audits had successfully identified 13 real-world examples of vulnerable implementations in the wild. The firm stated it was actively coordinating responsible disclosure processes with the affected decentralized projects. While ChainSecurity chose to withhold specific details regarding the 13 real-world examples and refrained from publicly naming the impacted projects, the company strongly urged all protocol and smart contract developers to audit their codebases as soon as possible.
These latest security discoveries compound earlier warnings issued by the Ethereum Foundation, which had previously cautioned that Glamsterdam’s shifting gas model could potentially break various developer tools, wallets, indexers, and gas estimation utilities that rely heavily on fixed operational assumptions. Prior to the planned Hoodi testnet deployment, the upgrade had already been successfully activated on the Sepolia testnet on October 6.
Comments (0)