Ethereum delays Glamsterdam Hoodi testnet launch over security risks
Ethereum developers have postponed the Glamsterdam hard fork on the Hoodi testnet after researchers identified gas-related security risks affecting smart contracts.
The Ethereum Foundation (EF) announced the delay to investigate how proposals EIP-8037 and EIP-8038 interact with existing smart contracts. The upgrade had been planned for Oct. 26 on the Hoodi testnet, with mainnet deployment potentially scheduled for early December.
On Oct. 13, ChainSecurity warned that the proposed changes could undermine safeguards against insufficient gas griefing attacks. Under the new rules, gas would be returned to a contract after an operation fails, potentially allowing it to continue running when it previously would have stopped.
Security Concerns
In such attacks, a malicious caller deliberately provides too little gas for a legitimate smart contract operation to succeed. ChainSecurity warned that affected contracts could permanently record failed operations, potentially removing a user's claim or disabling retry options.
The findings prompted concern among Ethereum contributors. In an Oct. 21 comment on GitHub, pseudonymous security researcher pcaversaccio described the risks as "serious" and called for a reassessment of the hard fork.
Next Steps
ChainSecurity said it had identified "13 real-world examples" and was coordinating responsible disclosure with affected projects. The security firm did not disclose details of the examples or identify the affected projects, but urged developers to check their contracts immediately.
The findings follow an earlier Ethereum Foundation warning that Glamsterdam's gas model could break wallets, indexers, and gas estimators. The upgrade was previously activated on Sepolia on Oct. 6, ahead of its now-postponed Hoodi deployment.
Related
