Ethereum Delays Glamsterdam Upgrade Over Gas Security Risks

Ethereum developers have postponed the Glamsterdam hard fork on the Hoodi testnet after security researchers flagged gas-related risks that could undermine safeguards in existing smart contracts. The upgrade, originally scheduled for Oct. 26, was called off during Thursday's All Core Devs Execution meeting to investigate how proposed changes interact with contracts already running on the main network Source: CoinDesk. No replacement date has been announced Source: CoinDesk.

The Security Concern

Blockchain security firm ChainSecurity warned on Oct. 13 that two proposals included in Glamsterdam, EIP-8037 and EIP-8038, could weaken protections against insufficient gas griefing attacks Source: Cointelegraph. Under the new rules, gas could be returned to a contract after an operation fails, allowing it to continue running when it previously would have stopped. This could interfere with existing security checks that rely on how much gas remains available during a transaction Source: Cointelegraph.

ChainSecurity said it had identified 13 real-world examples of contracts that could be affected and was coordinating responsible disclosure with impacted projects Source: Cointelegraph. The security firm did not disclose details of the examples or identify the affected projects. In an Oct. 21 comment on GitHub, pseudonymous security researcher pcaversaccio described the risks as "serious" and called for a reassessment of the hard fork Source: Cointelegraph.

What's Next

The postponement raises uncertainty over Glamsterdam's mainnet timeline. Ethereum developers had been considering early December, with plans to finalize a schedule following successful Hoodi testing Source: Cointelegraph. The findings follow an earlier Ethereum Foundation warning that Glamsterdam's gas model could break wallets, indexers, and gas estimators that rely on fixed assumptions Source: Cointelegraph.