Ethereum Delays Glamsterdam Hard Fork on Hoodi Testnet Over Security Concerns

Ethereum developers have delayed the deployment of the network’s next hard fork, Glamsterdam, on the Hoodi testnet because of security concerns.

Cointelegraph reported on October 23 that the Ethereum Foundation had postponed the Hoodi testnet’s Glamsterdam hard fork, which had been scheduled for October 26. Developers need more time to review how some of the proposals included in the upgrade interact with existing smart contracts.

The issue was first raised by blockchain security firm ChainSecurity. In a report published on October 13, the firm said two proposals included in Glamsterdam — EIP-8037 and EIP-8038 — could weaken existing defenses against an “insufficient gas griefing” attack. In that type of attack, a malicious caller deliberately supplies too little gas, disrupting the normal operation of a smart contract.

Under Glamsterdam’s new gas rules, gas could be returned to a contract even after certain operations fail. That means execution that would previously have halted could continue. In some cases, a contract could permanently record a failed operation, erase a user’s claim or disable a retry option. ChainSecurity said it had identified 13 such cases in contracts already deployed and was carrying out responsible disclosure procedures with the projects involved.

The concerns have also spread among Ethereum contributors. Security researcher pcaversaccio, in comments posted on GitHub, called the risk “serious” and urged a reconsideration of the hard fork.

The delay has increased uncertainty around Glamsterdam’s mainnet timeline. Developers had planned to consider a mainnet rollout in early December after completing validation on the Hoodi testnet. Glamsterdam was previously deployed successfully on the Sepolia testnet on October 6.