EIP-8037 Compatibility Risks Delay Hoodi Testnet's Glamsterdam Upgrade

on October 26, Ethereum Foundation researcher Toni Wahrstätter (@nero_eth) announced that core developers delayed the fork to upgrade the Hoodi testnet to Glamsterdam last week to review a report disclosed by security firm ChainSecurity (@chain_security). The report highlights potential interaction issues between EIP-8037 and certain contracts. ChainSecurity previously stated that it has identified 13 real-world cases and is conducting responsible disclosures with the affected projects.

Wahrstätter noted that contracts hardcoding gas forwarding are inherently affected by the repricing of operations like SSTORE. The newly discovered issue is that EIP-8037 breaks assumptions relied upon by some code: consumed gas can be returned midway through a transaction, increasing the gasleft() value. This could lead to two types of risks: first, an underflow when calculating the difference in the gas counter before and after a call, triggering a revert; second, gas returned from a failed subcall causes otherwise unreachable code paths to be executed, making the transaction appear successful. Additionally, since state gas reserves are not visible during execution, measuring call consumption via the GAS difference before and after the call may underestimate actual usage.

Wahrstätter stated that delaying the fork only buys time and does not solve the problem. A thorough investigation of contracts is required this week, and subsequent resolution may require coordination among application developers, core developers, auditors, and node operators, with the worst-case scenario necessitating updates to the specification. He urged application developers and auditors to check whether their contracts are impacted by EIP-8037/EIP-8038 and provide timely feedback.