Last week, core devs had to delay forking the Hoodi testnet to Glamsterdam to study a report by @chain_security which re | Hanami
Last week, core devs had to delay forking the Hoodi testnet to Glamsterdam to study a report by @chain_security which revealed some problems with how EIP-8037 interacts with a few contracts. Over the weekend, ppl tried to get a better picture of the impact and by now it's quite well understood. So here's what you need to know:
What's been known is that contracts which hardcode forwarded gas are affected by repricings, e.g. making state writes (SSTORE) more expensive.
What's new is that some coding patterns rely on specific invariant which were broken with EIP-8037.
Gas already spent can come back mid-tx, so gasleft() can go up. This causes two problems: (1) a before / after gas counter underflows and reverts (2) a failed sub-call hands gas back, so a path that should've been unreachable runs, and the tx looks like it succeeded
Related but different: (3) measuring the gas usage of a call using GAS - before and after the call - might undercount because the state gas reservoir is not visible during execution (e.g. gas_left).
It's now about deciding how to proceed. Delaying hoodi bought time but won't resolve the issue. This week, we have to dig deep into contracts and make sure nothing is missed. Eventually, this might just need some coordination among the involved parties (dapps, core devs, auditors, people running nodes, etc.), or worst-case, spec changes.
If you're an app dev or auditor, check your contracts for issues with EIP-8037/EIP-8038, and report them. Also, share this with your favorite app dev to spread awareness.