Ethereum developers have made the strategic decision to postpone the anticipated Glamsterdam hard fork on the Hoodi testnet. This course of action was taken after security researchers and auditors identified critical gas-related security risks that could fundamentally impact how existing smart contracts handle failed transactions across the network.
The Ethereum Foundation (EF) announced that the upgrade, which had been originally scheduled for deployment on October 26, would be delayed indefinitely to afford developers, core contributors, and researchers ample time to investigate how various improvement proposals interact with decentralized applications and smart contracts already deployed on Ethereum.
The discovery originated on October 13, when blockchain security firm ChainSecurity published a public warning detailing how two specific proposals included within the broader Glamsterdam upgrade package—designated as EIP-8037 and EIP-8038—could inadvertently weaken established safeguards against a sophisticated category of blockchain exploitation known as insufficient gas griefing.
This unexpected postponement immediately introduces a notable degree of uncertainty over the broader mainnet rollout timeline for Glamsterdam. Prior to these security findings, core Ethereum developers had been actively considering an early December target for the mainnet activation, with the formal plan being to finalize an exact scheduling date only after observing successful testing phases across the network’s public testnets, including Hoodi.
Gas Changes Could Undermine Existing Smart Contract Safeguards
In its technical analysis, ChainSecurity outlined how the introduction of these new rules could alter the fundamental economics and execution flow of transactions. Specifically, under the proposed changes, unused gas could potentially be returned to a contract following an operation failure, allowing the execution environment to continue running through code paths that previously would have halted immediately. The researchers emphasized that these subtle changes could directly interfere with existing security checks and logic validations that rely heavily on measuring how much gas remains available during the lifecycle of a transaction.
Insufficient gas griefing attacks occur when a malicious caller deliberately provides just enough—or rather, too little—gas for a legitimate smart contract operation to succeed, trapping the state in an unfavorable condition. ChainSecurity warned that Glamsterdam’s proposed modifications could undermine foundational safeguards designed to block such attacks. As a result, the upgrade could potentially allow contracts to permanently record failed operations as completed or terminal states under false pretenses.
To illustrate the severity of this vulnerability, an affected smart contract could inadvertently remove a user’s valid claim or disable the option to retry a failed operation entirely. This leaves the end user stranded, completely unable to complete an otherwise legitimate and valid financial or administrative operation on-chain.
ChainSecurity noted that the implementation of Glamsterdam would not render every single gas-related security check entirely unreliable across the board. Certain traditional safeguards might continue to function as intended, but application developers would still be required to manually review their existing codebases to ensure they appropriately account for the upgrade’s novel gas distribution rules and mechanics.
These findings quickly prompted widespread concern among the broader community of Ethereum contributors and core developers. Writing in a public GitHub discussion thread on October 21, pseudonymous security researcher pcaversaccio described the identified risks in stark terms, characterizing them as serious structural issues and calling for a comprehensive reassessment of the hard fork’s readiness.
Adding urgency to the situation, ChainSecurity revealed late last week that its ongoing research efforts had successfully identified thirteen real-world examples of vulnerable implementations in the wild. The firm stated that it was actively coordinating responsible disclosure processes with the various affected decentralized finance projects and development teams. While ChainSecurity opted not to publicly disclose specific details regarding these thirteen real-world examples or name the individual projects impacted, the firm strongly urged all independent developers to audit their smart contracts as soon as possible.
These latest security discoveries follow on the heels of an earlier, separate warning issued by the Ethereum Foundation, which cautioned that Glamsterdam’s revised gas model could potentially break third-party development tools, user wallets, blockchain indexers, and gas estimation utilities that rely heavily on fixed execution assumptions. Prior to the Hoodi testnet delay, the Glamsterdam upgrade had already been successfully activated on the Sepolia testnet on October 6, setting the stage for what was expected to be a smooth progression toward mainnet deployment before these security hurdles emerged.
