Developers released urgent security patches for Ethereum execution client Reth and major layer-2 networks including Base, Optimism, and Tempo following the discovery of a state-root calculation bug. Found via automated fuzzing by the Tempo team, the flaw risked node synchronization failures without exposing user funds. Protocols like LayerZero and Gauntlet took precautionary restrictions, while Base confirmed its independent proof system kept user assets fully safe.
Reth state-root bug discovery and impact
- ▪The Tempo development team discovered the Reth state-root software bug through automated security testing known as fuzzing
- ▪Georgios Konstantopoulos, chief technology officer at Paradigm, said a flaw in execution client Reth's legacy state-root calculation system could return incorrect cryptographic hashes when processing specific smart contract storage configurations
- ▪Reth's block-building software used vulnerable calculation code across networks built with Optimism's OP Stack, creating shared defect risks across multiple interconnected Ethereum layer-2 blockchains
- ▪Incorrect state-root calculations can cause blockchain nodes to disagree on block validity, potentially halting transaction processing or network synchronization across affected infrastructure
Software updates and fixes for reth
- ▪Developers merged pull request #28264 containing the upstream software fix into Reth's GitHub code repository
- ▪Paradigm chief technology officer Georgios Konstantopoulos announced software updates for execution client Reth version 2.10.0, Optimism OP Reth version 2.8.1, Base version 1.5.3, and Tempo
Base network response and mitigation
- ▪Coinbase-backed layer-2 network Base patched its block builders without impacting users
- ▪Base node software release version 1.5.3 prevents network validators from halting upon encountering invalid state roots without requiring operators to resynchronize their nodes
DeFi protocol risk management and precautions
- ▪Frax Finance reported on November 5, 2026, that its smart contracts and user assets remained secure despite LayerZero's temporary cross-chain route suspensions
- ▪Cross-chain messaging protocol LayerZero temporarily paused select transfer routes as a precautionary measure while developers evaluated operational risks related to the Reth state-root software defect
Security assessments and exploit risk evaluations
- ▪Paradigm CTO Georgios Konstantopoulos clarified that Base and other OP Stack networks avoided faulty withdrawal risks because ecosystem bridge mechanisms rely on separate transaction receipts or multisignature authorization
- ▪Security firm Blockaid warned that blockchain nodes still running unpatched Reth software code could freeze up or return faulty state proofs
- ▪Security firm Blockaid confirmed the Reth state-root calculation flaw was a code calculation error rather than an active exploit, with no stolen funds reported
Story comments
Loading comments…