Ethereum delays Glamsterdam Hoodi testnet launch over security risks
Ethereum developers have postponed the Glamsterdam hard fork on the Hoodi testnet after security researchers identified gas-related risks that could compromise existing smart contract safeguards.
Intelligence analysis by Gemini 2.5 Flash
The delay, originally scheduled for October 26, was prompted by warnings from blockchain security firm ChainSecurity regarding EIP-8037 and EIP-8038. These proposals could weaken protections against 'insufficient gas griefing' attacks, potentially allowing failed transactions to be permanently recorded and affecting user operations.
Imagine Ethereum is a big playground where kids (smart contracts) play games. Sometimes, a game needs a certain amount of energy (gas) to finish. If a kid doesn't bring enough energy, the game usually stops. But with a new rule called Glamsterdam, even if a game runs out of energy, it might still try to keep going, or record that it failed in a bad way. This could let a sneaky kid mess up other kids' games on purpose. So, the playground supervisors (developers) are pausing the new rule to make sure all the games stay fair and safe for everyone.
Analysis
Ethereum's decision to delay the Glamsterdam hard fork on its Hoodi testnet underscores the critical importance of security in blockchain development. The postponement, initially slated for October 26, was a direct response to findings by blockchain security firm ChainSecurity, which highlighted significant gas-related risks. These risks pertain to how smart contracts handle failed transactions, specifically concerning two proposals, EIP-8037 and EIP-8038, included in the Glamsterdam upgrade. The core issue revolves around changes to gas refund mechanisms, where gas could be returned to a contract even after an operation fails, potentially allowing it to continue running when it should have stopped. This interference with existing security checks could have far-reaching implications for the integrity of decentralized applications.
ChainSecurity
Blockchain security firm ChainSecurity played a pivotal role in identifying the vulnerabilities that led to the Glamsterdam delay. On October 13, the firm issued a warning, detailing how EIP-8037 and EIP-8038 could undermine safeguards against 'insufficient gas griefing' attacks. These attacks involve a malicious actor deliberately providing insufficient gas to prevent a legitimate smart contract operation from completing successfully. ChainSecurity's analysis indicated that the proposed gas changes could allow contracts to permanently record these failed operations, potentially leading to scenarios where users lose claims or are unable to retry valid transactions. The firm later confirmed it had identified 13 real-world examples of smart contracts potentially affected and is coordinating responsible disclosure with the respective projects, emphasizing the tangible nature of these risks.
EIP-8037 and EIP-8038
The specific proposals at the heart of the security concerns are EIP-8037 and EIP-8038. These Ethereum Improvement Proposals introduce changes to the network's gas model, which, while potentially offering benefits, were found to have unintended side effects on existing smart contract logic. ChainSecurity's research revealed that under the new rules, the way gas is managed and returned after a transaction fails could inadvertently create new attack vectors. This means that security checks designed to halt contract execution upon gas depletion might no longer function as intended, leaving contracts vulnerable to manipulation. The findings prompted significant concern among Ethereum contributors, with pseudonymous security researcher pcaversaccio describing the risks as "serious" and advocating for a comprehensive reassessment of the hard fork's implications.
Hoodi
The Glamsterdam hard fork was initially activated on the Sepolia testnet on October 6, with its subsequent deployment planned for the Hoodi testnet. The delay specifically impacts the Hoodi deployment, which is a crucial step before any consideration of a mainnet launch. Ethereum developers had been eyeing an early December timeline for the mainnet, contingent on successful testing on Hoodi. The postponement therefore introduces uncertainty into this timeline, as developers now need to thoroughly investigate the interaction of the proposals with deployed smart contracts. This meticulous approach on testnets like Hoodi is essential for identifying and mitigating potential issues in a controlled environment, preventing catastrophic failures on the live Ethereum mainnet and ensuring the stability and security of the entire network.
Key points
- Ethereum has delayed the Glamsterdam hard fork on the Hoodi testnet due to security risks.
- Blockchain security firm ChainSecurity identified gas-related vulnerabilities in EIP-8037 and EIP-8038.
- The risks involve 'insufficient gas griefing' attacks, where gas changes could undermine smart contract safeguards.
- ChainSecurity found 13 real-world examples of potentially affected smart contracts.
- The delay allows developers to investigate how proposals interact with existing smart contracts and ensure security.
The delay allows Ethereum developers to thoroughly investigate and fix the identified security vulnerabilities, ensuring that the Glamsterdam upgrade, when eventually deployed, will be more robust and secure. This proactive approach can prevent potential exploits and maintain user trust in the network's stability.
The postponement introduces uncertainty into Glamsterdam's mainnet timeline, potentially pushing back the upgrade beyond the initially considered early December schedule. This delay could also signal deeper, more complex issues within the proposed gas changes, requiring extensive re-evaluation and potentially leading to further delays or significant modifications.
