28264

• Reth merged the state root fix via pull request #28264 on Nov. 3 at 21:00 UTC.
• Reth shipped the fix in v2.10.0, rated high priority for payload-building and non-payload-building nodes.
• Base released node version v1.5.3, removing the risk of validators halting on an invalid state root.
Reth v2.10.0 Carries the High-Priority Fix
Reth shipped a high-priority fix for a bug that could in some cases leave a blockchain node with the wrong state root, the single hash that summarizes a chain's entire state, and Base put its own patched node release in front of operators by Thursday. A state root is how an Ethereum-style chain proves its own bookkeeping: if a client computes it incorrectly, that client diverges from its peers, and a validator running it can propose or attest to blocks the rest of the network rejects. Execution clients are the software layer that processes transactions and tracks balances, which is why a miscalculation there sits at the bottom of the entire stack. The patch landed in v2.10.0, and the maintainers rated the upgrade as high priority across the board, covering nodes that build blocks and nodes that only validate them, so no operator class was told to wait for a routine update slot. The underlying change went in through pull request #28264, merged on Nov. 3 at 21:00 UTC; timestamps on that merge and on Base's status notice put the window between the fix and the public alert at roughly 43 hours. Base discovered the bug on Nov. 4 and patched every one of its block builders, the machines that assemble new blocks, that same day. It then directed operators to its own node release, v1.5.3, which removes the chance that Base validators halt over an invalid state root, and said no resync is needed to apply it. Base runs on the OP Stack and leans on op-reth, the OP Stack build of Reth, which is where the reported incident surfaced. Both halves of that instruction matter: the upgrade closes the fault, while the resync waiver keeps the cost of applying it near zero for busy operators.
Base Confirms Its State Root, DeFi Takes Precautions
Base's status notice, posted Thursday, carried two messages at once: reassurance for users and instructions for operators. On the first, the chain said it had recomputed the state root and found it correct. “We've verified the current state root is correct and users were not affected,” the notice said, a line aimed squarely at heading off FUD around the incident. It backed that claim with architecture: Base's proof system checks every state root against a separate implementation, so a genuine mismatch would have been flagged, and that independent check is the load-bearing fact behind the all-clear. On the second, Base repeated the call to move to v1.5.3 and confirmed no resync was required. The reaction spread beyond the chain itself. Frax Finance said LayerZero “has temporarily paused certain cross-chain routes as a precaution and should resume soon,” tying the step to the reported incident in op-reth and saying none of its assets or smart contracts were affected. LayerZero moves assets between chains, so the pause briefly stopped tokens from crossing those routes. Gauntlet, the risk manager, restricted fresh deposits into its V1 vaults while keeping withdrawals open, paused allocations and was trimming exposure to LayerZero-bridged assets, saying it was not aware of any reported exploit; its post on the measures has since been deleted. Capping deposits while leaving withdrawals open is the standard posture for a risk desk that cannot yet fully model a system. A summary of Blockaid's posts, carried on a crypto exchange news feed, described the flaw as a calculation bug inside the nodes, not an attack, with no fund losses known, and warned that clients still on the old code could freeze or hand out faulty state proofs. The precautionary pauses came over six months on from the $292 million rsETH bridge exploit at Kelp DAO, an attack LayerZero attributed to North Korea's Lazarus Group; nothing has tied the Reth bug to any exploit.
The episode reads as a stress test of single-client dependency. Base, one of the busiest layer 2s, leans on one Rust client for execution, and a flaw at that layer pushed risk outward to bridge operators and risk managers within hours, even with no exploit on record. The architecture held: the proof system's independent recomputation is the reason no user impact surfaced, and because the fix arrived as a client release, not a fork of the chain, v1.5.3 needed no resync to apply. The release notes do the rest of the work, naming the change and rating it high priority for every operator type. The number that carries the story is 43 hours, the window between the merged upstream patch and the public notice that told operators to move.