A bug in Reth, the Ethereum execution client developed by Paradigm, prompted coordinated security measures across several Ethereum-compatible networks. Under certain conditions, the flaw could produce an incorrect state root, the cryptographic value summarizing a blockchain’s current state, including account balances and smart-contract data. If nodes calculate different values, synchronization or proofs of state may be affected. Paradigm’s chief technology officer said a specially crafted transaction could trigger the error in specific circumstances. Developers treated the incident as a software correctness issue; there were no confirmed financial losses or reports of funds stolen through the flaw.
Base identified the issue on November 4 and patched its block-building nodes that day. It later recalculated the state root independently and confirmed it was correct. The network said operations were not disrupted and that users and their funds were unaffected. Base version 1.5.3 also prevents validators from halting when they encounter invalid state roots. Node operators were advised to upgrade, although Base said they did not need to resynchronize their nodes. Reth published version 2.10.0, Optimism released OP Reth 2.8.1, and Base issued 1.5.3; Tempo also said it had patched the issue. Developers said withdrawal systems on Base and other OP Stack networks were not affected.
On November 6, BNB Chain said opBNB does not use op-reth and that exposure on BSC-Reth was limited. The team was working on a fix and monitoring the situation, while saying users and developers did not need to take action at that point. A separate update concerning BSC-Reth instructed mainnet and testnet node operators to install version v0.1.4 and restart their nodes. The release was dated November 3 and aligned with BSC v1.8.2. BNB Chain plans to move all validators to a Reth-based client by the end of 2026 and cited an approximately 40% increase in throughput in connection with the move to Reth.
The incident also prompted precautionary steps by some services beyond the execution clients directly involved. LayerZero temporarily restricted certain routes and off-chain infrastructure connected to affected networks. As a result, some cross-chain messages could be delayed, though reports said they would not be lost. Some DeFi services temporarily limited deposits or cross-chain routing while assessing their exposure. Frax said its assets and smart contracts continued to operate normally and that user funds were safe. Corrected software is available, but operators still need to install it; services can decide when to lift restrictions based on their own risk assessments.