Ethereum Reth bug prompts emergency patches on Base, Optimism and Tempo
Emergency patches follow a Reth state calculation flaw
A bug in Reth, an Ethereum execution client made by Paradigm, could cause incorrect blockchain state calculations. Paradigm and several networks using the software released emergency patches on Nov. 5.
Reth is software that processes transactions and checks the state of Ethereum. Layer-2 networks are smaller networks built on top of Ethereum to handle transactions.
Georgios Konstantopoulos, chief technology officer at Paradigm, said patches were released for Reth, Optimism, Base and Tempo.
Patches released for Reth, Optimism, Base and Tempo
- Reth version 2.10.0 was released and marked high priority for node operators, including block builders.
- Optimism released OP Reth v2.8.1.
- Base released version 1.5.3.
- Tempo was also patched after its team found the issue through automated security testing.
- Base said users were not affected and node operators would not need to resynchronize their nodes.
What Paradigm and Base said about the error
Konstantopoulos said the flaw was in Reth's legacy state-root calculation. A state root is a fingerprint that summarizes account balances and smart contract data on a blockchain.
He said the code could return a wrong result for certain smart contract storage setups. A carefully crafted transaction could trigger the error under specific conditions.
The Tempo team found the issue using fuzzing. Fuzzing means feeding software unusual inputs to look for errors.
Konstantopoulos said the vulnerable method was used in Reth block-building software on lower-end hardware and in networks built with Optimism's OP Stack. He also said withdrawals on Base and other OP Stack networks were not exposed to the bug.
Base said it found the Reth issue on Nov. 4 and patched its block builders. It also recalculated the state root to check it and said its proof system provides a separate check.
Base said: "We've verified the current state root is correct and users were not affected."
What is confirmed so far
The bug, the patch versions and the discovery timeline were confirmed by Paradigm and Base in the source material. No confirmed reports of funds stolen through the flaw were included.
Frax Finance reported on Nov. 5 that LayerZero had temporarily suspended certain cross-chain transfer routes while the situation was assessed. Frax said its assets and smart contracts were operating normally and user funds were safe.
What the LayerZero pause does not mean
The LayerZero restrictions did not show that LayerZero bridge contracts were vulnerable to the Reth bug, according to the source. The pause was described as a precaution by other services while assessing shared infrastructure risks.
Konstantopoulos also said ecosystem bridges generally rely on transaction receipt roots or multisignature authorization, rather than the affected state-root calculations.
Why shared software raised wider concern
Several networks rely on the same underlying execution software. That means one defect can affect more than one network at the same time.
Base's version 1.5.3 also prevents Base validators from halting when they encounter invalid state roots.
Node operators still need to install the fixes
The release of corrected software does not mean every independently operated node has installed it. Node operators are encouraged to upgrade to the patched versions.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.