Ethereum Delays Glamsterdam Hoodi Testnet Over Smart Contract Security Risks

Ethereum developers have postponed the Glamsterdam hard fork on the Hoodi testnet after blockchain security firm ChainSecurity identified gas-related vulnerabilities that could compromise how existing smart contracts handle failed transactions. The Ethereum Foundation confirmed the upgrade, originally scheduled for Oct. 26, will be delayed to give developers time to investigate how two included proposals—EIP-8037 and EIP-8038—interact with contracts already deployed on the network. The postponement casts uncertainty over Glamsterdam's mainnet timeline, which developers had been targeting for early December pending successful Hoodi testing.

At the core of the concern is a class of attacks known as insufficient gas griefing, in which a malicious caller deliberately supplies too little gas for a legitimate operation to complete. Under Glamsterdam's proposed gas changes, gas could be returned to a contract after an operation fails, allowing execution to continue when it would previously have stopped. ChainSecurity warned that this could undermine security checks relying on remaining gas levels, potentially allowing contracts to permanently record failed operations—for example, removing a user's claim or disabling retry options on an otherwise valid transaction. The firm identified 13 real-world examples of smart contracts potentially affected and is coordinating responsible disclosure with the impacted projects.

The findings drew strong reactions from Ethereum contributors. Pseudonymous security researcher pcaversaccio described the risks as "serious" in an Oct. 21 GitHub comment and called for a reassessment of the hard fork. ChainSecurity clarified that not all gas-related security checks would become unreliable—some safeguards could still function—but developers would need to audit them against the upgrade's new gas rules. The Ethereum Foundation had previously warned that some developer tools may break with the Glamsterdam upgrade, adding further urgency to the review process before any mainnet deployment proceeds.