A flaw in Ethereum execution client Reth could produce an incorrect blockchain state calculation when triggered by specific transactions. Reth, Optimism, Base and Tempo coordinated fixes around November 5. Paradigm CTO Georgios Konstantopoulos said withdrawal systems on the affected networks were not impacted, while Base said users were unaffected. Infrastructure operators still need to install the updates.
Bug affects Reth state-root calculations
The issue lies in older Reth code that calculates state roots and can mishandle an edge case involving certain smart-contract storage configurations. A state root is a cryptographic fingerprint of the blockchain’s current state, including account balances and contract data. If nodes calculate it incorrectly, they may disagree over whether a block is valid, potentially disrupting transaction processing or network synchronization.
Konstantopoulos said an attacker would need to craft a specific transaction to trigger the bug. The affected calculation path could be used in lower-performance hardware environments running Reth block-building software, as well as on networks built with the Optimism OP Stack. The issue was therefore not limited to Ethereum mainnet infrastructure.
Reth, Optimism, Base and Tempo issue fixes
Tempo’s development team found the bug through fuzz testing, an automated method that feeds software unusual or unexpected inputs to uncover errors that routine testing may miss. Paradigm released Reth 2.10.0, Optimism issued OP Reth v2.8.1 and Base released version 1.5.3. Konstantopoulos said Tempo had also completed a fix.
Reth classified the update as a high-priority task for node operators and also recommended that block builders upgrade. Because multiple networks rely on the same or related execution software, a flaw in shared underlying code can affect several chains. The coordinated response highlights the cross-project work that may be needed to address vulnerabilities in common infrastructure.
Base verifies state root as LayerZero restricts some routes
Base said its proof system uses an independent implementation to verify state roots. The team recalculated and checked the current state root, confirming it was correct, and said users were not affected. Base also said its withdrawal systems were unaffected by the calculation error. Bridges in its ecosystem typically rely on transaction receipt roots or multisignature authorization rather than the state-root calculation involved in the bug.
Base 1.5.3 also addresses a separate operational issue that could cause validators to stop when they encounter an invalid state root. Node operators should install the update, but Base said they do not need to resynchronize their nodes or take additional recovery steps.
On November 5, Frax Finance said cross-chain messaging protocol LayerZero had temporarily paused some transfer routes while it assessed the situation. Frax said its assets and smart contracts were operating normally and that user funds were safe. Available information did not indicate that LayerZero bridge contracts were affected by the Reth flaw; the restriction was a precaution while services assessed risks related to shared infrastructure.
There have been no confirmed reports of funds stolen through the state-root bug. Fixes are available, but operators run their nodes independently, so upgrades still need to be confirmed across the affected infrastructure. Services that were temporarily restricted also need to assess when to resume normal operations.