ChainSecurity identified 13 real-world contracts affected by Glamsterdam gas changes; Hoodi fork delayed as teams audit failure handlers that could break retry logic.
Tech & Launches ·
ChainSecurity identified 13 real-world contracts vulnerable to gas-handling issues associated with the Glamsterdam hard fork on Ethereum's Hoodi testnet, leading to a delay in the scheduled upgrade announced on October 22, 2026. The firm conducted responsible disclosure with affected projects while the Ethereum Foundation assessed the scope of the vulnerability.
The core issue stems from how failure handlers interact with revised gas mechanics. When an external call fails, a contract's failure handler can now complete execution in scenarios where it would previously have run out of gas and reverted. An attacker can intentionally supply insufficient gas to trigger a failure while leaving enough for the surrounding contract to permanently record that failure, according to ChainSecurity's technical analysis. This mechanism removes the ability to retry operations that should have remained recoverable.
The vulnerability hinges on two gas pools now available to failure handlers: a state-gas reservoir that travels with calls in full, distinct from the execution gas forwarding limit; and immediate refunds when storage is undone under Glamsterdam rules. ChainSecurity's disclosure examined EIP-8037 and EIP-8038 specifications but did not name the affected projects or their contract addresses. Teams have been asked to audit their contracts while the extent of impact remains under assessment.