Key Highlights
- Blockchain security firm ChainSecurity identified technical risks stemming from the concurrent rollout of Ethereum Improvement Proposals EIP-8037 and EIP-8038.
- The potential vulnerability involves altered error-handling outcomes during gas exhaustion in cross-contract calls, which could disrupt existing smart contracts.
- Ethereum developers have revised the upgrade roadmap and postponed the deployment of the Glamsterdam upgrade on the Hoodi testnet to conduct in-depth security evaluations.
ChainSecurity Identifies Technical Vulnerabilities in EIP Pair
In a technical assessment released on October 13, blockchain security firm ChainSecurity cautioned that the joint implementation of two proposed protocol changes—EIP-8037 and EIP-8038—could introduce unexpected operational risks across the Ethereum ecosystem. According to the firm’s findings, deploying both Ethereum Improvement Proposals simultaneously carries the potential to modify standard error-handling behavior whenever gas resources run out during execution calls between smart contracts.
The primary concern highlighted by ChainSecurity revolves around contract state predictability. Because gas depletion during inter-contract calls serves as an execution boundary, altering the mechanics of how failures are handled could prompt existing, actively deployed smart contracts to execute or terminate differently than originally designed under specific conditions. Such variations threaten to disrupt logic assumptions embedded in legacy decentralized applications (dApps).
Ethereum Developers Reschedule Testnet Deployment
Following the emergence of these findings, Ethereum core developers have moved to adjust the rollout timeline to facilitate a comprehensive analysis of the identified risks during the testing stages. As a direct consequence of this schedule revision, the planned release of the Glamsterdam upgrade on the Hoodi test network has been delayed, with no new deployment date confirmed at this stage.
Protocol contributors emphasized that the decision to pause does not indicate a cancellation of the planned network enhancements. Instead, the delay is intended to afford security researchers and core engineers adequate time to perform rigorous assessments before moving forward with active deployments. An updated roadmap for the Glasgow milestone is anticipated once the technical evaluations conclude, though developers have not yet published a timeline indicating when the security reviews will wrap up or when testing will resume.
Why This Matters
Maintaining backwards compatibility is a core requirement for Ethereum network upgrades. Protocol changes must seamlessly integrate new technical capabilities without undermining the functional logic of billions of dollars worth of immutable smart contracts already deployed on-chain. By halting the Hoodi testnet rollout of the Glamsterdam upgrade, developers are prioritizing system stability and smart contract integrity over accelerated delivery schedules, underscoring the critical role of independent third-party audits in the protocol governance pipeline.
Frequently Asked Questions
What specific issue was detected by ChainSecurity?
ChainSecurity revealed that combining EIP-8037 and EIP-8038 could alter error-handling behaviors when gas is exhausted during interactions between smart contracts, which might cause deployed contracts to respond unexpectedly under specific conditions.
Has the Glamsterdam upgrade been abandoned?
No, the upgrade has not been cancelled. Ethereum developers have postponed the Glamsterdam rollout on the Hoodi test network solely to provide sufficient time for deeper security reviews and testing.
When will the revised Ethereum testing schedule be released?
As of now, core developers have not announced definitive dates for the Hoodi testnet launch or the subsequent Glasgow schedule, noting that timeline updates will follow the completion of the ongoing security assessments.
