Ethereum Postpones Glamsterdam Hoodi Testnet Launch Over Gas Security Risks

Ethereum developers have delayed the Glamsterdam hard fork on the Hoodi testnet after security researchers flagged gas-related risks that could change how existing smart contracts handle failed transactions.

Hard forks are protocol-wide changes that require every node on the network to adopt the same new rules, and Ethereum's standard practice is to rehearse them on testnets such as Sepolia and Hoodi before any mainnet activation, where already-deployed contracts and real value are at stake. The Ethereum Foundation (EF) said the upgrade, originally scheduled for Oct. 26, was pushed back so developers could investigate how certain proposals within the fork interact with smart contracts already deployed on Ethereum.

The decision stems from an Oct. 13 warning by blockchain security firm ChainSecurity, which found that two proposals bundled into Glamsterdam — EIP-8037 and EIP-8038, formal specifications known as Ethereum Improvement Proposals — could weaken protections against a class of attack known as insufficient gas griefing.

Mainnet Timeline in Question

The postponement casts uncertainty over Glamsterdam's mainnet schedule. Developers had been eyeing early December and planned to finalize a timeline only after successful Hoodi testing, which left the testnet run as the deciding factor for the mainnet schedule and now leaves that date open.

The upgrade had already been activated on the Sepolia testnet on Oct. 6, ahead of the now-delayed Hoodi deployment.

How the Gas Changes Could Undermine Safeguards

According to ChainSecurity's analysis, the new rules would allow gas to be returned to a contract after an operation fails, letting it continue running in cases where it previously would have halted. The researchers said this could interfere with existing security checks that depend on how much gas remains available during a transaction.

In insufficient gas griefing attacks, a malicious caller deliberately supplies too little gas for a legitimate smart contract operation to complete. ChainSecurity warned that Glamsterdam's proposed changes could erode defenses against such attacks, potentially allowing contracts to permanently record failed operations. For example, an affected contract could remove a user's claim or disable the option to retry it, leaving the user unable to complete an otherwise valid operation.

The firm stressed that Glamsterdam would not make all gas-related security checks unreliable. Some safeguards could continue to work, but developers would need to review them to confirm they account for the upgrade's new gas rules.

Community Response

The findings prompted concern among Ethereum contributors. In an Oct. 21 comment on GitHub, pseudonymous security researcher pcaversaccio described the risks as "serious" and called for a reassessment of the hard fork.

On Friday, ChainSecurity said it had identified "13 real-world examples" and was coordinating responsible disclosure with the affected projects. The firm did not disclose details of the examples or name the projects involved, but urged developers to check their contracts as soon as possible.

The warning follows an earlier Ethereum Foundation advisory that Glamsterdam's gas model could break wallets, indexers, and gas estimators that rely on fixed assumptions.

With the mainnet timeline tied to a successful Hoodi run, the immediate items to watch are a rescheduled Hoodi activation, the outcome of ChainSecurity's responsible-disclosure process with the affected projects, and any further guidance building on the EF's advisory for wallets, indexers, and gas estimators.