After researchers pointed out security risks related to gas, Ethereum developers postponed the launch of a hard fork named Glamsterdam on the Hoodi test network.
The Ethereum Foundation ( EF ) announced that the upgrade scheduled for October 26 will be postponed to allow developers to investigate how certain proposals interact with smart contracts deployed on Ethereum.
On October 13, blockchain security company ChainSecurity warned that two proposals EIP-8037 and EIP-8038 contained within Glamsterdam could potentially weaken the protective measures against a type of attack known as "gas insufficient harassment (insufficient gas griefing)".
This delay has also added uncertainty to the mainnet timeline for Glamsterdam. Ethereum developers had previously been considering scheduling the mainnet upgrade for early December and planned to finalize the schedule after the successful testing on Hoodi.
gas Changes may weaken the protection of existing smart contracts
ChainSecurity stated in the analysis that under the new rules, gas may be returned to the contract after a certain operation fails, allowing it to continue running when it should have stopped beforehand. Researchers claim that these changes could interfere with existing security checks that rely on the remaining quantity of gas in the transactions.
In the so-called “gas insufficient harassment” attacks, malicious callers deliberately provide an insufficient amount of gas, preventing legitimate smart contract operations from succeeding. ChainSecurity warns that the proposed changes may weaken protections against such attacks and could even result in failed operations being permanently recorded by the contracts.
For example, affected contracts may remove users' eligibility to claim, or disable the retry option, preventing users from completing operations that were originally valid.
ChainSecurity indicates that Glamsterdam will not render all security checks related to gas ineffective. Some protective measures may still be effective, but developers need to re-examine these mechanisms to ensure they take into account the new gas rules after the upgrade.
Relevant: Ethereum Foundation warns that the Glamsterdam upgrade may cause some tools to become ineffective
These findings have raised concerns among Ethereum contributors. On October 21st, a security researcher using a pseudonym, pcaversaccio, commented on GitHub that these risks are "very serious" and called for a re-evaluation of this hard fork.
ChainSecurity On Friday, it was stated that "13 cases in the real world" had been identified, and efforts are being made to coordinate with the affected projects for responsible disclosure. The security company has not disclosed the details of these 13 cases, nor has it specified which projects were affected. However, the company advised developers to check their contracts as soon as possible.
These findings echo another warning from the Ethereum Foundation earlier on: The gas model of Glamsterdam may disrupt wallets, indexers, and gas estimators that rely on fixed assumptions. This upgrade was previously activated on Sepolia on October 6th, ahead of the now postponed Hoodi deployment.
