Ethereum Postpones Glamsterdam Testnet Upgrade Over Security Concerns

Ethereum postpones testnet launch

Ethereum developers have delayed the launch of the Glamsterdam upgrade on the Hoodi testnet. A testnet is a testing environment where developers can trial updates before they go live on the main network. The delay was announced after security researchers discovered risks related to gas, which is the fee required to conduct transactions or execute smart contracts.

Smart contracts are self-executing programs stored on a blockchain that run when certain conditions are met. The upgrade was originally scheduled to take place on October 26, but it has been put on hold to allow for further investigation into how the new rules interact with existing contracts.

Key facts about the delay

• The upgrade was postponed from its original October 26 date.
• Security firm ChainSecurity identified risks in two specific proposals: EIP-8037 and EIP-8038.
• ChainSecurity found 13 real-world examples of smart contracts that could be affected by the changes.
• The upgrade was already activated on the Sepolia testnet on October 6.

Ethereum Foundation confirms the pause

The Ethereum Foundation (EF) stated that the delay is necessary to investigate how the Glamsterdam proposals affect smart contracts already deployed on the network. This decision followed warnings that the new gas rules could weaken existing security safeguards.

Pseudonymous security researcher pcaversaccio also described the risks as serious in a public developer forum. The researcher called for a full reassessment of the hard fork, which is a major change to the blockchain's underlying software rules.

Security risks found in new gas rules

Researchers warned that the upgrade could lead to "insufficient gas griefing" attacks. In these attacks, a malicious user provides too little gas for a contract to finish its task correctly. Under the proposed new rules, gas could be returned to a contract after an operation fails, allowing it to keep running when it should have stopped.

ChainSecurity explained that this could interfere with security checks that rely on how much gas is left during a transaction. The firm is currently coordinating with affected projects to disclose the vulnerabilities responsibly. They have advised developers to review their contracts to see if they are impacted by the new gas rules.

Impact on smart contract security

The security flaw could cause smart contracts to permanently record failed operations. For example, a contract might incorrectly disable a user's claim or prevent them from retrying a valid transaction. While some security checks may still work, researchers believe the upgrade makes many existing safeguards unreliable.

The Ethereum Foundation had previously warned that the Glamsterdam gas model could also cause issues for digital wallets, indexers, and tools that estimate gas costs based on fixed assumptions.

Mainnet timeline remains uncertain

The postponement has created uncertainty regarding when Glamsterdam will launch on the main Ethereum network. Developers had previously discussed a target for early December. A final schedule was expected to be set after the Hoodi testnet launch, which is now on hold indefinitely while the team addresses the security concerns.

Sources

• Cointelegraph