Ethereum Delays Glamsterdam Fork on Hoodi Testnet Over Gas-Related Security Concerns

The Ethereum Foundation announced that the upgrade, which was originally set for October 26, will be delayed to provide developers additional time to examine how certain proposals might interact with smart contracts already deployed on the Ethereum network.

On October 13, blockchain security firm ChainSecurity warned that two proposals included in the Glamsterdam upgrade—EIP-8037 and EIP-8038—might weaken protections against a class of attacks known as insufficient gas griefing.

This postponement has generated uncertainty about when Glamsterdam will be deployed on the Ethereum mainnet. Developers were considering early December for the rollout, intending to finalize the schedule after successful testing on Hoodi.

ChainSecurity’s analysis revealed that under the updated gas rules, gas could be refunded to a contract even after an operation fails, allowing the contract to continue executing where it previously would have halted. This change could disrupt existing security checks that depend on the amount of gas remaining during a transaction.

In insufficient gas griefing attacks, a malicious actor deliberately supplies too little gas to successfully execute a legitimate smart contract operation. ChainSecurity warned that the proposed changes in Glamsterdam could weaken defenses against such attacks, potentially enabling contracts to permanently log failed operations.

For example, a vulnerable contract might revoke a user's privilege to perform an operation or disable retry mechanisms, effectively preventing the user from completing an otherwise valid action.

ChainSecurity noted that not all gas-related security mechanisms would become unreliable due to Glamsterdam. Some safeguards would still function, but developers must reassess their contracts to accommodate the new gas handling rules introduced by the upgrade.

These findings raised significant concern within the Ethereum community. On October 21, a pseudonymous security researcher going by pcaversaccio commented on GitHub, labeling the risks as 'serious' and urging a reevaluation of the proposed hard fork.

On Friday, ChainSecurity reported identifying '13 real-world examples' of impacted contracts and is currently coordinating responsible disclosure efforts with affected projects. Although specific details and project names were not revealed, they advised developers to review their contracts promptly.

These developments come after the Ethereum Foundation previously warned that Glamsterdam’s revised gas model might disrupt wallets, indexers, and gas estimation systems that assume fixed gas behaviors. The upgrade had already been activated on the Sepolia testnet on October 6 before the delayed rollout on Hoodi.

The Glamsterdam delay highlights critical security implications of changing gas mechanics in Ethereum, underscoring the need for thorough evaluation of how protocol upgrades affect smart contract safety and network stability.

Understanding and addressing gas-related vulnerabilities is vital to maintaining Ethereum’s security and reliability as the network evolves.