Reth and Base release emergency patches for state root calculation bug
Developers across the Ethereum execution client Reth and Layer 2 network Base have issued high-priority software patches after discovering a legacy calculation flaw that could cause nodes to produce incorrect state roots.
Core developers across the Reth ecosystem have deployed coordinated updates following the discovery of an edge case in Reth's legacy state root code. Discovered through fuzzing by the Tempo team, the vulnerability allowed carefully crafted transactions targeting specific smart contract storage layouts to trigger incorrect state root calculations. In response, maintainers urged node operators to upgrade to Reth v2.10.0, OP Reth v2.8.1, and Base v1.5.3, labeling the release high priority for both payload-building and non-payload-building nodes.[1][2]
According to Reth core developer Georgios Konstantopoulos, Reth's block builder relies on the legacy trie calculator on OP Stack networks and lower-end hardware, leaving those configurations exposed. However, Konstantopoulos noted that Layer 2 withdrawals and ecosystem bridges were unaffected because they rely on receipt roots or multisignatures rather than state roots. Base separately confirmed in a status update that its users experienced no impact, explaining that it patched all block builders on Nov. 4 and verified that the network's state root remained correct. Base added that node operators updating to v1.5.3 do not need to resync.[1][2][3]
The bug prompted precautionary measures across decentralized finance protocols before the patch rollout. LayerZero temporarily paused select cross-chain routes, while risk manager Gauntlet briefly restricted new deposits into its V1 vaults and paused allocations, though neither reported any loss of funds. Security firm Blockaid stressed that the issue was an internal calculation flaw rather than an exploit, though it warned that unpatched nodes could freeze up or return invalid state proofs.[2][3]
Key facts
- Reth, OP Reth, and Base released coordinated software patches across versions v2.10.0, v2.8.1, and v1.5.3 to fix an edge case in Reth's legacy state root code.
- The flaw allowed crafted transactions matching specific smart contract storage layouts to produce an incorrect state root on setups using the legacy trie calculator.
- The vulnerability was identified through fuzzing by the Tempo team, which has also been patched.
- The upstream fix, pull request #28264, was merged into Reth's codebase on Nov. 3 at 21:00 UTC.
- Base patched its block builders on Nov. 4 and stated that users were unaffected after verifying that the chain's state root remained correct.
- Security firm Blockaid and protocol teams reported no fund losses or active exploits linked to the calculation flaw.
- LayerZero temporarily halted select cross-chain routes and Gauntlet restricted new V1 vault deposits as precautionary measures following reports of the vulnerability.
Sources · 3 sources
- GK
Georgios Konstantopoulos@gakonstPost on X ·
PSA on today's Reth / OP Reth releases A fix went out across the Reth ecosystem ensuring that all Reth-based nodes, DeFi bridges and state-proof backed systems are all safe. If you depend on Reth, please update to v.2.10.0, OP Reth v2.8.1, and Base version v1.5.3. We appreciate how quickly everyone moved to patch. This bug was identified by the Tempo team's fuzzing process, and Tempo is also patched. Reth’s legacy state root code had an edge case. For certain smart contract storage layouts, a carefully crafted transaction could make it produce the wrong state root. Reth’s block builder uses this legacy trie calculator on lower-end hardware and on OP Stack chains, so those setups were exposed. L2s like OP Stack chains or Base are unaffected because this could not impact their withdrawals system. Ecosystem bridges do not use state roots, they use receipt roots or multisignatures, so they are unaffected by this. Reth is critical infrastructure for the entire EVM ecosystem. We take it very seriously. And we are sorry for the inconvenience caused.
Open source - UN
UnchainedArticle ·
Base Says Users Unaffected as Reth and Base Ship Fixes for State Root Bug Base said in a status notice Thursday that its users were not affected by a bug in Reth , the execution client the chain is built on, that could in some cases leave a node with the wrong state root , the single hash that summarizes a blockchain’s entire state. Reth’s maintainers listed the fix in v2.10.0 and rated the upgrade high priority for both payload-building and non-payload-building nodes. Base released node version v1.5.3 , which it says removes the risk of Base validators halting on an invalid state root, and told operators they don’t need to resync. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . What Base Confirmed Base said it recomputed the chain’s state root and confirmed it was correct. “We’ve verified the current state root is correct and users were not affected,” Base wrote. Its proof system checks every state root with a separate implementation and would have flagged a mismatch, the notice said. Base says the bug was discovered on Nov. 4 and that it patched all of its block builders the same day. The upstream fix, pull request #28264 , was merged into Reth’s code a day earlier, on Nov. 3 at 21:00 UTC, about 43 hours before Base posted its notice, by Unchained’s count of the GitHub and Base status timestamps. Precautions in DeFi Frax Finance said in a post that LayerZero “has temporarily paused certain cross-chain routes as a precaution and should resume soon.” Frax tied the post to a reported incident in op-reth , the OP Stack build of Reth, and said none of its assets or smart contracts were affected. The Defiant reported earlier Thursday, citing Gauntlet , that the risk manager had restricted new deposits into its V1 vaults without halting withdrawals after a reported op-reth vulnerability. Gauntlet had also paused allocations and was reducing its exposure to LayerZero -bridged assets, according to The Defiant’s report , and said it knew of no reported exploit. Gauntlet’s X post on the measures has since been deleted. No Exploit Reported Security firm Blockaid said the flaw was a bug in how nodes calculate results, not an attack, and that no fund losses were known, according to a KuCoin summary of its posts. Blockaid warned that nodes still running the old code could freeze up or return faulty state proofs, the summary said. The route pauses Frax described come more than six months after a $292 million exploit of Kelp DAO’s rsETH bridge, which LayerZero linked to North Korea’s Lazarus Group . No source has tied the Reth bug to any exploit. Related Listen: Who’s to Blame for How KelpDAO’s DVN Was Set Up? KelpDAO or LayerZero? The post Base Says Users Unaffected as Reth and Base Ship Fixes for State Root Bug appeared first on Unchained .
Open source - LS
Laura Shin@laurashinPost on X ·
Base says it patched all its block builders the day it says the Reth state root bug was found, Nov. 4. Frax Finance says LayerZero paused some cross-chain routes as a precaution after a reported op-reth incident. https://t.co/X07zteEWKh
Open source