A bug in the Reth Ethereum execution client could cause affected nodes to calculate incorrect state roots, creating risks for synchronization and state proofs. Base said it patched its block-building nodes and verified its state root. BNB Chain said opBNB does not use op-reth and described exposure on BSC-Reth as limited.
- The issue was a software correctness bug, not a confirmed exploit.
- Base reported no service disruption or user impact.
- BNB Chain said it was preparing a BSC-Reth hotfix.
- Precautionary restrictions delayed some cross-chain messages, but reports said they would not be lost.
What the Reth bug could affect
Reth is an Ethereum execution client developed by Paradigm. Execution clients process transactions and maintain data about accounts, balances and smart-contract storage. The reported bug involved a trie iterator, a component that searches stored blockchain data, and how it handled certain cached branch boundaries during incremental state-root calculations.
A state root is a cryptographic value that represents a blockchain’s current state. Blockaid warned that unpatched clients could run into synchronization problems or return incorrect state proofs through the eth_getProof interface. A state proof lets software check whether account or contract data is part of a blockchain’s state.
The available incident details do not establish exactly what triggers the incorrect calculation or how many nodes encountered it. There is also no confirmation that the issue caused a chain-wide disagreement or consensus failure. An incorrect result from one client can cause problems for systems that rely on it, but it does not, on its own, mean consensus failed or funds were stolen.
A change merged into Reth’s code on November 3 corrected the iterator behavior and added a regression test for incremental state-root calculations. The fix was included in Reth 2.10.0. Related patched releases included op-reth 2.8.1 and Base 1.5.3.
Base says it patched its block-building nodes
Base said it found the issue on November 4 and patched all its block-building nodes that day. It said the issue was resolved on November 5, after it recalculated the network’s state root and confirmed the value was correct. The network has also supported other projects, including an NFT collection launched on Base.
“We’ve verified the current state root is correct and users were not affected, ” Base said.
Base also said its proof system independently verifies every state root. The available details do not explain how that verification works, so the claim reflects Base’s description of its safeguard, not independent evidence that every possible client or infrastructure error is ruled out. Base reported no service disruption or impact to user funds.
Base’s version 1.5.3 update addressed the issue and was designed to prevent validators from halting when they encounter invalid state roots. Base advised node operators to install it as soon as possible. It said operators would not need to resynchronize their nodes or take additional recovery steps. The public patch became available at 17:52 UTC on November 5. Base did not specify how many operators had installed it. The network has also been used for USDC stablecoin payments.
BNB Chain distinguishes opBNB from BSC-Reth
On November 6, BNB Chain said opBNB does not use op-reth. The team described exposure on BSC-Reth as limited, said developers were preparing a hotfix and advised developers and users that they did not need to act at that time.
Those statements refer to different deployments. opBNB’s reported software use does not establish whether BSC-Reth was exposed. BNB Chain did not explain what “limited” exposure meant or say which operators were affected. The team’s comments do not mean every BNB Chain deployment was vulnerable, or that none was.
Precautionary restrictions delayed some cross-chain activity
LayerZero temporarily suspended some off-chain infrastructure connected to affected networks. Reports said the restrictions delayed some cross-chain messages but would not cause them to be lost. The available details do not identify all affected networks or services, or say when the restrictions were lifted.
Some decentralized finance services also restricted deposits or cross-chain routing while they assessed their exposure. The Defiant reported that risk-management firm Gauntlet curtailed deposits and allocations. The available details do not say which markets were affected or how long the measures lasted.
These were precautionary responses, not evidence of an attack. Blockaid described the issue as a software correctness bug rather than a confirmed exploit and reported no known financial losses associated with it. “No known losses” is a limited assessment. It does not show that every deployment was unaffected.
What operators and users should know
Node operators should follow guidance for the specific client and network they run. Reth, op-reth and Base’s patched software are related but distinct implementations. Do not assume an update for one applies to another. Base specifically advised operators to install version 1.5.3.
The reports did not call for broad emergency action from users. If a cross-chain transfer is pending, check status updates from the relevant network or application before taking further steps. The reported restrictions affected some infrastructure and messages, not necessarily every cross-chain transfer.
Key questions and answers
-
What could the Reth bug do?
Blockaid warned that unpatched clients could have synchronization problems or return incorrect state proofs. The available details do not show how many nodes encountered an incorrect result or establish that a chain-wide consensus failure occurred.
-
Was Base affected?
Base said it patched its block-building nodes, verified that its recalculated state root was correct, and saw no service disruption or user impact.
-
Was opBNB exposed through op-reth?
BNB Chain said opBNB does not use op-reth. It described exposure on BSC-Reth as limited and said a hotfix was being prepared.
-
Was there a confirmed exploit or financial loss?
Blockaid described the issue as a software correctness bug, not a confirmed exploit, and reported no known financial losses.
-
Were cross-chain messages lost?
LayerZero’s precautionary restrictions reportedly delayed some messages. Reports said they would not be lost, though the available details do not identify every affected service or say when restrictions ended.
