ChainSecurity said it identified 13 real-world examples of smart contracts potentially affected by Glamsterdam’s gas changes and is coordinating responsible disclosure with affected projects.

Ethereum developers have postponed the Glamsterdam hard fork on the Hoodi testnet after researchers identified gas-related security risks that could affect how existing smart contracts handle failed transactions.

The Ethereum Foundation (EF) said that the upgrade, originally scheduled for Oct. 26, would be delayed to allow developers to investigate how some proposals interact with smart contracts deployed on Ethereum.

On Oct. 13, Blockchain security firm ChainSecurity warned that two proposals included in Glamsterdam, EIP-8037 and EIP-8038, could weaken safeguards against a type of attack called insufficient gas griefing.

The postponement raises uncertainty over Glamsterdam’s mainnet timeline. Ethereum developers had been considering early December, with plans to finalize a schedule following successful Hoodi testing.

In its analysis, ChainSecurity said that under the new rules, gas could be returned to a contract after an operation fails, allowing it to continue running when it previously would have stopped. The researchers said the changes could interfere with existing security checks that rely on how much gas remains available during a transaction.

In attacks known as insufficient gas griefing, a malicious caller deliberately provides too little gas for a legitimate smart contract operation to succeed. ChainSecurity warned that Glamsterdam’s proposed changes could undermine safeguards against such attacks, potentially allowing contracts to permanently record failed operations.

For example, an affected contract could remove a user’s claim or disable the option to retry it, leaving the user unable to complete an otherwise valid operation.

Source link