Ethereum developers have postponed the Glamsterdam hard fork on the Hoodi testnet after security researchers flagged gas-related risks that could affect how existing smart contracts handle failed transactions.

The Ethereum Foundation (EF) said the upgrade, originally scheduled for Oct. 26, would be delayed so developers can investigate how some of its proposals interact with smart contracts already deployed on Ethereum. Smart contracts are generally immutable once deployed, which is why Ethereum stages forks — network-wide rule changes — on public testnets like Hoodi before any mainnet activation is scheduled.

The decision follows an Oct. 13 warning from blockchain security firm ChainSecurity, which said two proposals included in Glamsterdam, EIP-8037 and EIP-8038, could weaken safeguards against a type of attack known as insufficient gas griefing. EIPs — Ethereum Improvement Proposals — are the formal specifications through which changes to the network's rules are proposed and adopted.

The postponement also clouds Glamsterdam's mainnet timeline. Developers had been weighing an early December launch, with plans to finalize a schedule only after successful Hoodi testing.

Gas rule changes could undermine existing safeguards

In its analysis, ChainSecurity said that under the new rules, gas could be returned to a contract after an operation fails, allowing it to continue running where it previously would have halted. The researchers said the changes could interfere with existing security checks that rely on how much gas remains available during a transaction. Gas is the unit of computation users pay for on Ethereum, which is why changes to its accounting rules can affect tooling and contracts well beyond the two proposals themselves.

In insufficient gas griefing attacks, a malicious caller deliberately supplies too little gas for a legitimate smart contract operation to complete — a form of griefing, a class of attack aimed at disrupting a system rather than directly stealing from it. ChainSecurity warned that Glamsterdam's proposed changes could undermine defenses against such attacks, potentially allowing contracts to permanently record failed operations. An affected contract could, for example, remove a user's claim or disable the option to retry it, leaving the user unable to complete an otherwise valid operation.

ChainSecurity noted that Glamsterdam would not make all gas-related security checks unreliable. Some safeguards could still function, but developers would need to review them to ensure they account for the upgrade's new gas rules.

The findings prompted concern among Ethereum contributors. In an Oct. 21 comment on GitHub, pseudonymous security researcher pcaversaccio described the risks as "serious" and called for a reassessment of the hard fork.

On Friday, ChainSecurity said in a post on X that it had identified "13 real-world examples" and was coordinating responsible disclosure with affected projects. The firm did not disclose details of the examples or name the projects involved, but urged developers to check their contracts as soon as possible.

The delay follows an earlier Ethereum Foundation warning that Glamsterdam's gas model could break wallets, indexers, and gas estimators that rely on fixed assumptions. The upgrade was previously activated on the Sepolia testnet on Oct. 6, ahead of its now-postponed Hoodi deployment. A replacement date for the Hoodi fork has not been announced, and with mainnet timing contingent on a successful Hoodi run, the near-term markers for Glamsterdam are the revised testnet schedule and further outcomes from ChainSecurity's coordinated disclosure.