Crypto: Potential Vulnerability Threatens Ethereum Upgrade

Ethereum could disrupt up to 200,000 smart contracts with its upcoming Glamsterdam update. Developer banteg warns of risks related to new gas calculation rules, which could prevent some existing contracts from functioning properly. Two competing proposals were submitted on November 8 to avoid these problems. The Ethereum Foundation has already suspended a planned test on Hoodi.

Ethereum identifies a risk for 200,000 smart contracts

The warning is growing. On October 26, Ethereum had already postponed a Glamsterdam test after discovering risks on 13 contracts. Two weeks later, developer banteg mentions a list of about 200,000 potentially concerned contracts. This figure comes from an analysis tool for the effects of the new gas pricing. It does not mean that 200,000 contracts will necessarily break down.

Banteg even estimates that the method used might miss other vulnerable contracts. The problem concerns two proposals integrated into Glamsterdam: EIP-8037 and EIP-8038. The first changes the cost of creating permanent data on Ethereum. The second increases certain fees related to their consultation and modification.

The change is significant. With EIP-8037, the base cost of creating a smart contract would increase from 32,000 to 183,600 gas units, before additional fees related to the code and its execution. Gas measures the computing resources needed for operations performed on Ethereum. Some older smart contracts were programmed with fixed limits. When they call another contract, they allocate a precise amount of gas to it.

If this amount becomes insufficient after Glamsterdam, the operation can fail. The problem particularly concerns immutable contracts, whose code cannot be modified after deployment. Some DeFi protocols might encounter difficulties during their crypto transactions. Funds could also become temporarily inaccessible in some scenarios. However, no massive breakdown of this type has been observed on the main network.

Two developers propose competing solutions

Faced with concerns, Leo Glisic and Giulio Rebuffo presented two different approaches on November 8. The first, named EIP-8488, seeks to preserve old rules for already deployed contracts.

Leo Glisic proposes creating two sets of instructions. Existing contracts would continue to operate with current gas costs. New contracts would use instructions adapted to the rates introduced by EIP-8037 and EIP-8038.

The goal is to avoid changing the execution conditions of historical applications. Giulio Rebuffo advocates another method. His proposal provides two gas counters for each crypto transaction. The first would track execution according to the old rules, while the second would calculate the fees actually charged according to the new rates.

Users would thus pay the new costs, but old contracts would maintain accounting compatible with their initial functioning. This solution would require a more significant adaptation of Ethereum software.

Rebuffo acknowledges that no implementation in execution clients nor any consensus test has yet been carried out. Both proposals remain in draft form. No decision has been made regarding their integration into Glamsterdam.

The work follows several months of preparation. Ethereum had already activated Glamsterdam on the Sepolia test network on October 6. The next step was to take place on Hoodi, but security researchers found new incompatibilities.

Glamsterdam will wait for problems to be resolved

The Ethereum Foundation made its decision official on November 6. Developers will not proceed with deployment on Hoodi until the risks related to the new gas rules have been resolved.

Cybersecurity companies ChainSecurity and Dedaub are participating in the verifications. The Foundation also published a list of eight technical assumptions on which some contracts rely and which could become invalid with Glamsterdam.

It asks developers and auditors to review their applications. Concerned projects can send their observations directly to the Ethereum teams. The next private test was scheduled between November 16 and 20 at the earliest. However, this timeline was discussed before the submission of the two new proposals.

No new definitive date has been announced. Deployment on the main network will depend on the corrections retained and the results of upcoming tests. Glamsterdam nevertheless pursues an important goal: increasing Ethereum’s capacity while controlling the growth of its database.

The update is notably supposed to facilitate parallel processing of transactions and improve block production organization. Work on Hegotá, the next update, continues in parallel.

For crypto developers, the immediate priority concerns the compatibility of already deployed applications. Ethereum is also preparing an increase in its gas limit from 60 to 200 million per block. This evolution could increase the network’s capacity, but it must not compromise contracts that already secure funds. Upcoming developer meetings will have to choose between the proposed solutions before restarting tests.