Ethereum developers have postponed the Glamsterdam hard fork on the Hoodi testnet, originally scheduled for October 26, following security warnings regarding gas-related risks. The Ethereum Foundation announced the delay to allow further investigation into how specific proposals interact with existing smart contracts. The core concern stems from EIP-8037 and EIP-8038, which ChainSecurity warned could weaken safeguards against "insufficient gas griefing" attacks. These attacks involve malicious actors providing too little gas to cause legitimate operations to fail, potentially allowing contracts to permanently record failed states or disable user retries.
ChainSecurity identified 13 real-world examples of affected projects and is coordinating responsible disclosure, though specific details remain undisclosed. The firm noted that while not all gas-related checks would become unreliable, developers must review their contracts to ensure compatibility with the new gas rules. This development follows an earlier warning from the Ethereum Foundation that the upgrade’s gas model could break wallets, indexers, and gas estimators relying on fixed assumptions. The Glamsterdam upgrade had previously been activated on the Sepolia testnet on October 6. The postponement introduces uncertainty regarding the mainnet launch timeline, which developers had tentatively considered for early December pending successful Hoodi testing.
The delay highlights the tension between protocol optimization and backward compatibility in Ethereum's roadmap. By pausing the Hoodi deployment, developers are prioritizing the integrity of existing decentralized applications over strict adherence to a release schedule. This decision underscores that even well-vetted upgrades can introduce subtle vulnerabilities when interacting with complex, pre-existing contract logic, particularly concerning gas accounting mechanisms.
For the broader ecosystem, this incident serves as a critical reminder for smart contract developers to audit their dependencies on gas behavior rather than assuming static execution models. The identification of 13 real-world examples suggests that the risk is not theoretical but present in live deployments. Stakeholders should monitor the resolution of these specific cases, as the final adjustments to EIP-8037 and EIP-8038 will likely set precedents for how future gas-related changes are evaluated for security impact before mainnet activation.
