Ethereum developers have put the Glamsterdam upgrade on hold for the Hoodi testnet after auditors found eight assumptions in existing contracts that the new gas rules could break. The Ethereum Foundation wants developers and auditors to report affected projects before core developers decide whether to change the specifications.
Ethereum developers have delayed the Glamsterdam upgrade on the Hoodi testnet after security researchers identified eight smart contract assumptions that could become invalid under the proposed changes to gas accounting. In a November 6 blog post, the Ethereum Foundation said auditing firm ChainSecurity had identified several projects that could become vulnerable once EIP-8037 and EIP-8038 take effect.
Both proposals change how Ethereum charges gas for certain operations, particularly those involving the creation and access of blockchain state. Some existing contracts depend on fixed gas costs or assumptions about how much gas remains after an operation fails.
ChainSecurity flags eight compatibility concerns
ChainSecurity detailed the concerns in an October 13 analysis of contracts that continue executing after an external call fails. Under current rules, some contracts depend on a failed operation leaving too little gas for later instructions to complete. Glamsterdam's revised accounting could allow certain operations to finish even when developers expected the entire transaction to revert.
One example involves contracts that mark an operation as unsuccessful after an external call runs out of gas. Under the new rules, previously unavailable gas could become accessible again, so the contract could record a permanent failure.
The Foundation has published a GitHub repository documenting eight affected invariants, with explanations, examples and instructions for developers to check their own code. The repository identifies fixed gas budgets and gas reserves as the most common issues found so far.
Hoodi activation stays on hold
The findings add detail to Ethereum's earlier decision to postpone the Hoodi activation, originally scheduled for October 26 at 17:42:48 UTC. No replacement date has been announced.
Ethereum Foundation developer Marius van der Wijden said the organization is working with ChainSecurity and Dedaub while conducting internal audits. However, the Foundation acknowledged that its reviews cannot cover every Ethereum project, particularly where vulnerabilities involve interactions between smart contracts and off-chain infrastructure.
It has therefore asked developers and independent auditors to submit findings before the next All Core Developers discussions. Depending on the feedback, developers may consider adjustments to EIP-8037 and EIP-8038 before proceeding with the upgrade.
Work on Ethereum's subsequent Hegotá upgrade will continue in parallel and remains unaffected by the Glamsterdam delay, according to the Foundation.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
