BSC-Reth Hotfix Fixes State-Root Bug; Operators Urged to Upgrade
BNB Chain has released a hotfix for BSC-Reth after finding a bug in Reth’s legacy trie code that could lead to incorrect state-root calculations. BNB Chain says there is no evidence of exploitation or affected funds, but urges BSC-Reth node operators to upgrade and restart.
- Fix: BSC-Reth v0.1.4-hotfix corrects the state-root calculation bug.
- Who should act: BSC-Reth operators should upgrade and restart their nodes.
- Users: No action is needed. BNB Chain says there is no need for a database migration or hard fork.
- Scope: BNB Chain says opBNB is unaffected.
What the bug could do
BNB Chain says the issue was in Reth’s legacy trie code, which organizes blockchain data. The bug could produce an incorrect state root, a cryptographic commitment nodes use to check whether they agree on the blockchain’s state.
Different state-root calculations could leave nodes disagreeing about which state to recognize or unable to synchronize properly. BNB Chain cited possible financial loss as a potential consequence, but reported no evidence that the bug had been exploited or funds affected. A lack of known evidence does not prove exploitation was impossible.
Who needs to upgrade
BNB Chain published BSC-Reth v0.1.4-hotfix on GitHub. The release notes say the update fixes incorrect state-root calculations in Reth’s legacy path. The underlying correction is identified in Reth pull request #28264.
BNB Chain urged BSC-Reth operators, including validators, MEV builders, full nodes, and sentry nodes, to install the hotfix and restart their nodes as soon as possible. This is a client-software update, not a consensus-level hard fork. BNB Chain says it requires no database migration or protocol change. Regular users do not need to act, and opBNB is not affected.
Reported dates need clarification
BNB Chain’s reported timeline dates the vulnerability’s discovery to November 4, 2026. It says Reth pull request #28264 was merged on November 3, but does not give a year. The hotfix was published on November 6, also without a year.
A code fix can be merged before a vulnerability is formally recognized, so the dates alone do not prove there is a contradiction. Still, the available information does not explain the sequence or confirm the years for the merge and release.
Key questions and answers
-
What does BSC-Reth v0.1.4-hotfix fix?
It fixes a bug in Reth’s legacy trie code that could produce incorrect state-root calculations.
-
Who needs to upgrade, and do users need to act?
BSC-Reth operators, including validators, MEV builders, full nodes, and sentry nodes, should upgrade and restart. Regular users do not need to take action.
-
Was the bug exploited, and are funds known to be affected?
BNB Chain reports no evidence of exploitation or affected funds. The potential risks include nodes disagreeing, synchronization failures, and possible financial loss.
-
Does the fix require a hard fork or database migration?
No. BNB Chain says neither is required.
-
Is opBNB affected?
BNB Chain says the issue is limited to BSC-Reth and does not affect opBNB.
-
What is unclear about the timeline?
The reported discovery date is November 4, 2026, while the fix is listed as merged on November 3. The year for the merge and the November 6 hotfix release is unspecified, and BNB Chain has not explained the sequence.
