Ethereum developers have postponed the Glamsterdam hard fork on the Hoodi testnet after researchers identified gas-related security risks that could affect how existing smart contracts handle failed transactions.
The Ethereum Foundation (EF) said that the upgrade, originally scheduled for Oct. 26, would be delayed to allow developers to investigate how some proposals interact with smart contracts deployed on Ethereum.
On Oct. 13, Blockchain security firm ChainSecurity warned that two proposals included in Glamsterdam, EIP-8037 and EIP-8038, could weaken safeguards against a type of attack called insufficient gas griefing.
The postponement raises uncertainty over Glamsterdam’s mainnet timeline. Ethereum developers had been considering early December, with plans to finalize a schedule following successful Hoodi testing.
Gas changes could undermine existing smart contract safeguards
In its analysis, ChainSecurity said that under the new rules, gas could be returned to a contract after an operation fails, allowing it to continue running when it previously would have stopped. The researchers said the changes could interfere with existing security checks that rely on how much gas remains available during a transaction.
In attacks known as insufficient gas griefing, a malicious caller deliberately provides too little gas for a legitimate smart contract operation to succeed. ChainSecurity warned that Glamsterdam’s proposed changes could undermine safeguards against such attacks, potentially allowing contracts to permanently record failed operations.
For example, an affected contract could remove a user’s claim or disable the option to retry it, leaving the user unable to complete an otherwise valid operation.
ChainSecurity said Glamsterdam would not make all gas-related security checks unreliable. Some safeguards could still work, but developers would need to review them to ensure they account for the upgrade’s new gas rules.
Related: Ethereum Foundation warns some tools may break with Glamsterdam upgrade
The findings prompted concern among Ethereum contributors. In an Oct. 21 comment on GitHub, pseudonymous security researcher pcaversaccio described the risks as “serious” and called for a reassessment of the hard fork.
On Friday, ChainSecurity said it had identified “13 real-world examples” and was coordinating responsible disclosure with affected projects. The security firm did not disclose details of the 13 real-world examples or identify the affected projects. However, the company said developers should check their contracts as soon as possible.
The findings follow an earlier Ethereum Foundation warning that Glamsterdam’s gas model could break wallets, indexers, and gas estimators that rely on fixed assumptions. The upgrade was previously activated on Sepolia on Oct. 6, ahead of its now-postponed Hoodi deployment.
