Ethereum Developers Delay Hard Fork Amid Gas Security Concerns
Ethereum developers have postponed the planned Glamsterdam hard fork on the Hoodi testnet following the identification of gas-related security risks. These risks could potentially impact how existing smart contracts handle failed transactions.
Upgrade Postponed to Allow for Further Investigation
The Ethereum Foundation (EF) announced that the upgrade, initially slated for October 26, will be delayed. This pause will provide developers with the necessary time to thoroughly investigate the interactions between certain proposals within Glamsterdam and smart contracts already deployed on the Ethereum network.
Security Firm Flags Potential Vulnerabilities
On October 13, blockchain security firm ChainSecurity issued a warning regarding two proposals, EIP-8037 and EIP-8038, included in the Glamsterdam upgrade. ChainSecurity stated that these proposals could weaken existing safeguards against a type of attack known as “insufficient gas griefing.”
The postponement introduces uncertainty regarding the timeline for Glamsterdam’s mainnet launch. Ethereum developers had been targeting early December for the mainnet deployment, with a finalized schedule contingent on the success of the Hoodi testing phase.
How Gas Changes Could Affect Smart Contracts
ChainSecurity’s analysis indicated that under the proposed new rules, gas could be returned to a contract even after an operation fails. This could allow the contract to continue executing when it would have previously halted. The researchers cautioned that these changes might interfere with current security mechanisms that depend on the amount of gas available during a transaction.
In insufficient gas griefing attacks, a malicious actor intentionally provides insufficient gas for a legitimate smart contract operation to complete successfully. ChainSecurity warned that Glamsterdam’s proposed modifications could undermine protections against such attacks, potentially enabling contracts to permanently record failed operations.
For instance, an affected contract might revoke a user’s claim or disable the option to retry a failed operation, effectively preventing the user from completing a valid transaction.
ChainSecurity clarified that Glamsterdam would not render all gas-related security checks unreliable. Some safeguards might remain effective, but developers would need to review them to ensure they adequately account for the upgrade’s new gas rules.
Contributors Express Concerns
The findings have generated concern among Ethereum contributors. In a GitHub comment on October 21, pseudonymous security researcher pcaversaccio described the identified risks as “serious” and advocated for a reassessment of the hard fork.
On Friday, ChainSecurity reported identifying “13 real-world examples” of potentially affected smart contracts and is coordinating responsible disclosure with the projects involved. While the firm did not reveal specific details about these examples or name the affected projects, it urged developers to review their contracts promptly.
These revelations follow an earlier warning from the Ethereum Foundation that Glamsterdam’s gas model could disrupt wallets, indexers, and gas estimators that rely on fixed assumptions. The upgrade had previously been activated on the Sepolia testnet on October 6, prior to its now-delayed deployment on Hoodi.
