Ethereum developers have postponed the Glamsterdam upgrade on the Hoodi testnet after security researchers discovered a flaw that could turn temporary smart contract failures into permanent losses of functionality. Chainsecurity identified 13 deployed contracts with potentially vulnerable behavior. The Oct. 26 activation has been canceled, putting Ethereum’s tentative December mainnet upgrade window in doubt while developers investigate.
Key Takeaways
- Ethereum developers canceled Glamsterdam’s Oct. 26 Hoodi activation following security concerns.
- Swiss blockchain cybersecurity and smart contract auditing firm Chainsecurity identified 13 deployed contracts vulnerable to potentially permanent failure states.
- Ethereum’s tentative December launch faces uncertainty, but mainnet users need take no action.
Ethereum Delays Glamsterdam Testing After Security Flaws Threaten Contracts
Ethereum’s next major upgrade has hit an unexpected obstacle. Security researchers discovered that proposed changes to how the blockchain charges transaction fees can cause certain smart contracts to permanently record failures that previously would have been reversible.
Chainsecurity identified 13 deployed contracts exhibiting potentially dangerous behavior, prompting developers to cancel Glamsterdam’s Oct. 26 activation on the Hoodi test network. The discovery threatens an ambitious upgrade intended to make Ethereum faster and more efficient, with its tentative December launch now facing uncertainty.
A Security Discovery Forces Ethereum to Change Plans
During the Oct. 22 All Core Developers Execution meeting, developers agreed to postpone testing after reviewing findings involving two proposals, EIP-8037 and EIP-8038. The changes modify how the Ethereum protocol calculates gas, the fee mechanism that determines how much computing work a transaction can perform.
Chainsecurity found that certain operations might unexpectedly return previously consumed gas to a transaction. That seemingly helpful behavior creates a serious problem for smart contracts designed around existing spending limits.
When a Failed Transaction Becomes Permanent
Some smart contracts deliberately stop an operation when insufficient gas remains, allowing users to try again later. Under the proposed rules, however, a failed operation might leave enough gas for the surrounding contract to finish recording the failure. That can permanently disable a retry option or erase a user’s ability to claim funds.
The contract’s code wouldn’t necessarily need to change for the problem to appear. Researchers haven’t publicly identified the 13 affected contracts while responsible disclosure continues.
December Upgrade Window Faces Uncertainty
Glamsterdam combines improvements intended to increase Ethereum’s processing capacity and make block validation more efficient. Earlier testing on Sepolia succeeded on Oct. 6, with blocks operating near a 200 million gas limit, more than three times Ethereum mainnet’s roughly 60 million.
Hoodi operators must now install updated execution and consensus software before the canceled activation. Regular Ethereum users need take no action. The Ethereum Foundation hasn’t announced a replacement testing date or confirmed a mainnet launch. Developers must now determine whether changes intended to improve network performance can safely coexist with contracts already operating under older rules.