Ethereum developers have delayed the “Glamsterdam” hard fork scheduled for the Hoodi testnet after researchers flagged gas-related security risks that may affect how smart contracts behave when transactions fail.
According to a statement from the Ethereum Foundation (EF) on Oct. 22, the upgrade—initially set for Oct. 26—will be postponed to give teams time to investigate how certain proposals interact with already-deployed contracts on Ethereum. The delay adds fresh uncertainty to Glamsterdam’s broader roadmap, with developers previously pointing to an early December window for a potential mainnet schedule after successful Hoodi testing.
Key takeaways
- The Ethereum Foundation postponed the Glamsterdam hard fork on Hoodi testnet, originally due Oct. 26, to investigate security implications tied to gas behavior.
- Security firm ChainSecurity warned that two Glamsterdam proposals (EIP-8037 and EIP-8038) could weaken defenses against insufficient gas griefing.
- Researchers say the proposed gas changes could allow contracts to continue after failures in ways that existing safeguards don’t account for.
- Ethereum teams had been considering an early December mainnet direction, contingent on Hoodi test outcomes that now remain in flux.
EF delays Hoodi deployment while contract interactions are reviewed
The Ethereum Foundation said the Glamsterdam upgrade on Hoodi has been pushed back so developers can examine “how some proposals interact with smart contracts deployed on Ethereum.” In practical terms, this means teams want more clarity on whether the upgrade’s gas model changes create unexpected execution paths for contracts written under older assumptions—especially around what happens after a transaction fails.
That review matters because smart contracts often encode security logic based on how transaction execution consumes gas and how failures propagate. If those assumptions no longer hold, safeguards can become incomplete, and user-facing functionality may behave differently than developers intended.
ChainSecurity highlights risks from EIP-8037 and EIP-8038
Earlier, on Oct. 13, ChainSecurity published an analysis warning that two proposals included in Glamsterdam—EIP-8037 and EIP-8038—could undermine protections against insufficient gas griefing.
According to ChainSecurity, the new rules could enable gas to be returned to a contract after an operation fails. In the firm’s view, this could interfere with existing security checks that rely on the amount of gas remaining during a transaction.
Insufficient gas griefing is a class of attack where a malicious caller deliberately provides too little gas for a legitimate smart contract operation to succeed. If protections assume a failure will halt or roll back specific contract behavior in a particular way, then a change in gas handling could allow contracts to “continue” where they previously would have stopped—potentially leaving contracts in a state that records a failure as if it were final.
ChainSecurity provided a concrete example: an affected contract might remove a user’s claim or disable the user’s ability to retry, even though the original operation could have been valid under normal conditions.
Importantly, ChainSecurity stated that Glamsterdam would not make every gas-related security check unreliable. Some safeguards might still function, but developers would need to audit their contracts to ensure they correctly account for the upgrade’s revised gas rules.
Earlier coverage from Cointelegraph noted that the Ethereum Foundation had also warned that the Glamsterdam gas model might break wallets, indexers, and gas estimators that depend on fixed assumptions. The new postponement indicates that even beyond tooling, contract-level security assumptions are now a central concern.
Community pressure follows “serious” concerns and a larger set of examples
After ChainSecurity’s warning, contributors reacted with urgency. In an Oct. 21 GitHub comment, pseudonymous security researcher pcaversaccio described the risks as “serious” and urged a reassessment of the hard fork.
Then on Friday, ChainSecurity said it had identified “13 real-world examples” and was coordinating responsible disclosure with affected projects. The firm did not provide details of those examples or name the impacted entities in its public statement. However, it urged developers to check their contracts as soon as possible.
For Ethereum users and integrators, the practical implication is that the risk isn’t limited to purely theoretical edge cases. Even without published details, the existence of multiple real-world scenarios increases the chance that widely used contracts could require updates or configuration changes once Glamsterdam activates.
What this means for Glamsterdam’s timetable
Glamsterdam is not the first stage of the process. Cointelegraph previously reported that the upgrade had already been activated on the Sepolia testnet on Oct. 6, ahead of the now-postponed Hoodi deployment.
With Hoodi delayed, teams lose a key validation step: verifying that gas-model changes work as expected under the conditions that mimic mainnet behavior. Ethereum developers had been considering an early December timeframe for finalizing a mainnet schedule, reportedly after successful Hoodi testing. That sequencing now looks less certain, since the EF is explicitly waiting for more investigation into how proposals interact with deployed smart contracts.
For investors and builders, the takeaway is that “testnet activated” does not automatically mean “mainnet safe.” The current situation highlights how upgrades involving execution and gas semantics can introduce security and compatibility issues that only become clear after deeper review and broader analysis across contract logic.
Readers should watch for additional technical findings from the Ethereum Foundation and any further disclosures from ChainSecurity about which contract patterns are most affected and what mitigations developers should apply before the next testnet or mainnet decisions.
https://www.cryptobreaking.com/ethereum-pushes-back-glamsterdam-hoodi-2/?utm_source=blogger%20&utm_medium=social_auto&utm_campaign=Ethereum%20Pushes%20Back%20Glamsterdam%20Hoodi%20Testnet%20Launch%20Over%20Security%20Risks%20
Comments
Post a Comment