ChainSecurity identified 13 real-world smart contracts potentially impacted by Glamsterdam’s gas changes and is being coordinated with affected projects for responsible disclosure.
Ethereum core engineers delayed the Glamsterdam upgrade on Hoodi’s test network after researchers uncovered gas-related vulnerabilities that could alter how failed transactions are handled by existing smart contracts.
The Ethereum Foundation confirmed that the upgrade, initially set for Oct. 26, would face a brief delay while developers investigate how specific proposals interact with smart contracts deployed on the network.
On Oct. 13, blockchain audit firm ChainSecurity warned that EIP-8037 and EIP-8038, two proposals included in Glamsterdam, could weaken defenses against an exploit known as insufficient gas griefing.
This brief delay fuels fresh uncertainty around Glamsterdam’s mainnet rollout, which core developers aimed for early December pending dates to be finalized after successful Hoodi testing.
Proposed Gas Changes Could Weaken Existing Smart Contract Security
According to ChainSecurity’s analysis, revised gas rules might allow failed operations to return unused gas back to a contract, enabling execution when it previously stopped. Researchers noted these adjustments could disrupt existing security controls relied on by protocols to measure remaining transaction gas.
During exploits known as insufficient gas griefing, bad actors intentionally provide inadequate gas to sabotage legitimate smart contract executions. ChainSecurity cautioned that Glamsterdam’s proposed modifications could compromise protection against these attacks, potentially enabling failed transactions to be recorded permanently on-chain.
For instance, an impacted contract might revoke a user’s claim or disable retry attempts, leaving the victim unable to complete an otherwise valid execution that was targeted.
ChainSecurity noted that Glamsterdam won’t render every gas-related safeguard unreliable, as certain defenses will still function properly once core developers review them to ensure new rules are accounted for.
These findings sparked deep concern across Ethereum contributors, with pseudonymous security researcher pcaversaccio describing the risks as “serious” on GitHub while demanding that the upcoming hard fork be reassessed.
On Friday, ChainSecurity reported discovering 13 real-world cases and confirmed active coordination for responsible disclosure alongside impacted teams. Although the audit firm withheld specific project details, developers were advised to audit their smart contracts immediately.
These findings follow a prior Ethereum Foundation warning that Glamsterdam’s gas model could break wallets, indexers, and estimation tools built on rigid assumptions, after the upgrade was activated on Sepolia back on Oct. 6 ahead of its delayed Hoodi deployment.
