Sainteur · Highly Regarded Market News

Crypto

Ethereum delays Glamsterdam test after a security firm flags a risk to existing contracts

Core developers postponed the upgrade's Oct. 26 Hoodi testnet launch to study how a gas change interacts with contracts on mainnet. The Ethereum Foundation says ETH holders don't need to do anything.

By ·

For information only, not investment advice.

Ethereum developers have pushed back the next test of Glamsterdam, the network's upcoming upgrade, after a security firm flagged a risk to contracts already running on mainnet. The upgrade was set to hit the Hoodi testnet on Oct. 26 at 17:42:48 UTC. The Ethereum Foundation says it has been postponed and "A new activation date has not been set." Core developers made the call on Thursday's All Core Devs Execution call (#248) to dig into how one proposal, EIP-8037, interacts with mainnet smart contracts. The delay also pulls a planned raise of Hoodi's gas limit to 200 million.

The problem, per ChainSecurity's Oct. 13 analysis of EIP-8037 and EIP-8038: new gas refills and repricing can let a contract's failure handler finish where it used to revert. That sounds harmless until an attacker deliberately sends too little gas, turning an operation that could have been retried into a permanent failure, a trick known as insufficient gas griefing.

ChainSecurity said on X it has "already found 13 real-world examples" and is in responsible disclosure with the affected projects, which it didn't name. That count is the firm's own. CoinDesk notes ChainSecurity hasn't publicly shown that a major production protocol is exploitable, and the findings don't indicate existing contracts are being exploited now.

For holders, this is a testnet delay. The foundation says it sets no mainnet date and "no action is required from Ethereum mainnet users or ETH holders." Glamsterdam has run on the Sepolia testnet since Oct. 6. The homework falls to Hoodi node and validator operators, who need to update any configuration still scheduled for the old activation time.

Sources

  1. Glamsterdam Hoodi delay, Ethereum Foundation Blog
  2. Glamsterdam Hoodi announcement, Ethereum Foundation Blog
  3. Glamsterdam gas analysis, ChainSecurity
  4. ChainSecurity post on the Hoodi delay, X (@chain_security)
  5. Ethereum delays Glamsterdam test after security devs flag risk to existing contracts, CoinDesk

Tags: ethereum