Ethereum developers postponed the launch of the Glamsterdam hard fork on the HooKey testnet after researchers identified gas-related security risks.
The Ethereum Foundation (EF) stated that the upgrade scheduled for October 26 will be delayed to allow developers to investigate how certain proposals interact with smart contracts deployed on Ethereum.
On October 13, blockchain security firm ChainSecurity warned that two proposals included in Glamsterdam—EIP-8037 and EIP-8038—could weaken protections against an attack known as "insufficient gas griefing."
This delay has also introduced uncertainty into the Glamsterdam mainnet timeline. Ethereum developers had previously been considering scheduling the mainnet upgrade for early December, with plans to finalize the schedule following a successful Hoodi test.
Gas changes may weaken existing smart contract protections.
ChainSecurity stated in its analysis that, under the new rules, gas may be refunded to the contract after an operation fails, allowing it to continue running, whereas previously it should have stopped. Researchers noted that these changes could disrupt existing security checks that rely on the amount of remaining gas in a transaction.
In so-called "insufficient gas harassment" attacks, malicious callers intentionally provide too little gas, causing legitimate smart contract operations to fail. ChainSecurity warns that the proposed changes to Glamsterdam could weaken defenses against such attacks and potentially cause contracts to permanently log failed operations.
For example, affected contracts may remove users' eligibility to claim or disable retry options, preventing users from completing actions that were originally valid.
ChainSecurity stated that Glamsterdam does not render all gas-related security checks ineffective. Some protections may still work, but developers need to re-examine these mechanisms to ensure they account for the new gas rules after the upgrade.
Related: The Ethereum Foundation warns that the Glamsterdam upgrade may cause some tools to become inoperative.
These findings have raised concerns among Ethereum contributors. On October 21, a security researcher using the pseudonym pcaversaccio commented on GitHub that these risks are "serious" and called for a reassessment of this hard fork.
ChainSecurity stated on Friday that it has identified "13 real-world cases" and is coordinating with affected projects on responsible disclosure. The security firm did not disclose details of these 13 cases or specify which projects were impacted. However, the company advised developers to check their contracts as soon as possible.
These findings echo another warning previously issued by the Ethereum Foundation: Glamsterdam’s gas model could disrupt wallets, indexers, and gas estimators that rely on fixed assumptions. This upgrade was previously activated on Sepolia on October 6, prior to the now-delayed Hoodi deployment.