Ethereum delays Glamsterdam testnet upgrade over gas security risks

The decision was made during the All Core Devs Execution meeting to investigate interactions between EIP-8037 and mainnet smart contracts. This postponement removes the planned activation of the Amsterdam execution layer and the Gloas consensus layer. It also cancels the gas-limit schedule that would have raised Hoodi's gas limit to 200 million at the same epoch.

The delay stems from security concerns raised by ChainSecurity. The firm published an analysis on October 13 showing that EIP-8037 and EIP-8038 could alter how contracts respond when called contracts run out of gas. Under the proposed rules, gas used to create certain records can be restored when those changes are undone. ChainSecurity calculated that creating a new storage slot could require 110,020 gas under the new rules, compared with 22,100 under the old rules. This change could allow contracts to continue running after an operation fails, potentially making errors permanent.

ChainSecurity identified 13 real-world examples of smart contracts potentially affected by these gas changes. The firm warned that the updates could weaken safeguards against insufficient gas griefing attacks. Pseudonymous security researcher pcaversaccio described the risks as serious in a comment on GitHub on October 21. The postponement does not revert Hoodi's chain history but rolls back the configuration for the future upgrade.

Hoodi node and validator operators must update their clients before October 26 to reflect the postponed activation. The core developers decided to delay the upgrade via ACDE #248 to ensure thorough investigation of the identified issues.