Ethereum Postpones Glamsterdam Testing as Developers Warn of Contract Risks

The Ethereum development team has postponed the Glamsterdam upgrade for Monday in the Hoodi test network after researchers discovered a vulnerability in the code that might affect the way existing smart contracts deal with failed transactions. It was planned to go live on October 26 at 17:42:48 UTC. The upgrade had been put off for further evaluation in light of an All Core Devs Execution meeting held by developers on Thursday. This was to determine how the new gas accounting method proposed for Ethereum interacted with existing contracts. 

EIP-8037 Could Change Gas Refunds and Storage Costs Under the Proposed Rules

The issue revolves around EIP-8037, which modifies how Ethereum fees are calculated for adding new entries to its database. This proposal seeks to curtail the size of this database as Ethereum increases the number of transactions it can handle through its network. Analysis on October 13 by security firm ChainSecurity found that the update, along with EIP-8038, could affect how smart contracts react in situations where a called contract runs out of gas, which is the fee for paying the network operators.   

Other types of smart contract logic are meant to detect the failure of an operation and continue to perform other functions. They might have recorded an operation's failure, prevented any more operations from occurring, or shifted onto other logic functions. At times, developers depend on the residual gas left for those actions to fail, which reverses the entire operation.

The new scheme of Glamsterdam disrupts this process as well because under the suggested regulations, if a record is reversed, the gas that was used in creating this record will be refunded. This might lead to a surplus of gas needed for handling failure.

The problem may occur the other way around as well. ChainSecurity found that creating a new storage slot would need 110,020 gas once the separate allowance runs out, against 22,100 gas allowed by the previous rule. The contract may fail to complete a legitimate transaction due to a lack of gas budget. 

The results relate to the behavior of current software under the proposed rules. ChainSecurity has proven the technique but hasn't made it public that one of the protocols in production is vulnerable. Glamsterdam introduces several features to Ethereum, among which are a novel way to choose block builders and improvements that should allow the blockchain to process larger blocks.

The network had announced the launch of the Glamsterdam update on the testnet in September, bringing its upcoming scaling solution closer to being tested on a live network. As per the announcement, its largest changes include alterations to block building, block validation, and state handling by clients while processing transactions. Operators of nodes in Sepolia must have the appropriate version of both their execution and consensus clients before activation.