Ethereum developers have indefinitely postponed the Glamsterdam upgrade, originally slated for the Hoodi testnet on October 26th. This decision, made during the All Core Devs Execution (ACDE) #248 meeting on October 22nd, stems from security vulnerabilities identified by ChainSecurity concerning gas changes in EIP-8037 and EIP-8038. These changes could potentially weaken smart contract defenses against insufficient gas griefing attacks.
ChainSecurity reported that the identified gas modifications might allow malicious actors to intentionally cause operations to fail while still allowing contracts to record state changes. This could lead to scenarios where valid operations become permanently unfinishable, potentially affecting user claim eligibility or disabling retry options. According to ChainSecurity, 13 real-world contracts have been identified as potentially affected, and the firm is coordinating responsible disclosure with the relevant projects.
The postponement has removed the original launch date from the schedule, impacting the broader mainnet upgrade timeline. The mainnet schedule’s anchor point has been lost, making its progression dependent on the results of an investigation into the contract impact of EIP-8037. Developers are advised to review their contracts for reliance on old gas assumptions, particularly those that record state after a call failure, and to check for reliance on gasleft() fixed assumptions.
While the decision to halt the upgrade at the testnet stage is viewed as a positive step for long-term network security, it introduces uncertainty regarding the upgrade’s timeline. If the investigation extends beyond November, the year-end launch window could be compressed or potentially pushed to early 2027. Applications and tools that rely on the new Glamsterdam gas model will also face an extended period of uncertainty.
Hoodi testnet node and validator operators have been instructed to check and update their client software and network settings. This situation highlights a critical trade-off between the timely delivery of upgrades and the imperative of maintaining robust network security. Further analysis of the identified vulnerabilities and their impact on the ecosystem is ongoing, with Ethereum developers working to navigate the revised roadmap.
Why This Matters
The indefinite postponement of Ethereum’s Glamsterdam upgrade due to identified gas-related vulnerabilities underscores the network’s commitment to security over strict adherence to schedules. This decision, while introducing uncertainty into the upgrade timeline, reflects a proactive approach to risk management by halting the process at the testnet stage to address critical issues, thereby safeguarding the integrity of the mainnet and the broader ecosystem.
Broader Context
Ethereum developers decided at the ACDE #248 meeting on October 22nd to indefinitely postpone the Glamsterdam hard fork, originally set for the Hoodi testnet on October 26th. This decision was primarily driven by ChainSecurity’s findings regarding potential vulnerabilities in gas changes within EIP-8037 and EIP-8038, which could impact smart contract security against insufficient gas griefing attacks. ChainSecurity has identified 13 real-world contracts that may be affected and is coordinating responsible disclosure. The postponement removes a key anchor for the mainnet upgrade schedule, introducing a period of uncertainty as the impact of these vulnerabilities is investigated.
