Reth state root bug: how Base patched its layer 2

A bug in Reth, the execution client that the Base network runs on, sometimes made a node hold an incorrect state root. Base says its users were not affected, and both Reth and Base have shipped fixes, according to Unchained. This article explains what a state root is, why a bad one matters, and what node operators now have to install.

The change in one paragraph

Reth's maintainers placed the fix in version v2.10.0, which they class as a high-priority update for every kind of node: those that build payloads and those that do not. Base followed with its own node release, v1.5.3. Base says this release ends the chance of its validators halting on an invalid state root. Base says operators do not have to resync. In its status notice, Base said: "We’ve verified the current state root is correct and users were not affected".

What is layer 2, and where does Reth sit?

A layer 2 is a separate chain that processes transactions on its own and then anchors its results to a base chain such as Ethereum. Base is one of these networks, built on the OP Stack, a shared code base for this kind of chain. The software that runs its transactions and tracks balances is the execution client.

Reth is one such client. op-reth is its OP Stack build, the version a chain like Base uses. A bug in the client is therefore a bug in the engine of the chain, not in any single app or smart contract that runs on top of it.

Under the hood: how a state root works

A blockchain's state is the full record of every account, balance and contract storage slot at a given block. Nobody compares that whole record directly. Instead, nodes arrange the data in a tree and hash it upward until a single value remains. That one hash is the state root. If even one balance differs, the root changes completely.

This is why a wrong root is serious. Every node that follows the chain computes the root itself after each block and checks it against the one in the block header. A node that computes a different value will reject the block or stop. That is the halt risk Base's release is meant to remove.

• Payload-building nodes assemble new blocks and write the state root into them. The root they write is what other nodes check.
• Non-payload-building nodes only follow and verify blocks. Blockaid warned that nodes left on old code might freeze.
• State proofs are answers a node gives about a single account, backed by the root. Security firm Blockaid warned that nodes left on old code might freeze or serve faulty proofs.
• The proof system is Base's separate check. According to the notice, it verifies each state root with an independent implementation and would have caught a mismatch.

That last point is the key design lesson. When a chain relies on one client, a client bug becomes a chain bug. A second, independent implementation that recomputes the same root turns a silent error into a visible disagreement. Base said it recalculated the root and found it correct. That recalculation is what its statement that users were unaffected rests on.

Who is affected

For ordinary Base users, Base says nothing changed. Blockaid described the flaw as a calculation bug inside nodes, not an attack, with no known loss of funds, as summarised by KuCoin and cited by Unchained. Unchained also noted that no source has tied the bug to any exploit.

The work falls on node operators, who need to run the patched releases. Some DeFi firms acted on their own as a precaution. Frax Finance said LayerZero paused certain cross-chain routes after a reported op-reth incident, and that its own assets and contracts were untouched. The Defiant, citing Gauntlet, reported that the risk manager limited new deposits to its V1 vaults while keeping withdrawals open, paused allocations and cut exposure to LayerZero-bridged assets. Gauntlet said it knew of no reported exploit, and its post describing the steps was later deleted.

Bridges and DeFi vaults carry real risk, and people can lose money in them, so they are sensitive to this kind of news. Unchained pointed out that the pauses follow, by more than six months, a $292 million exploit of the Kelp DAO rsETH bridge. A bridge trusts what one chain says about its state, so any doubt about a state root reaches bridged assets first.

Timeline and next steps

Reth's maintainers merged the code change, pull request #28264, at 21:00 UTC on Nov. 3. Base says the bug surfaced on Nov. 4 and that it patched every one of its block builders that same day. Its public notice followed on Thursday, roughly 43 hours after the merge by Unchained's count.

The remaining step is adoption. Reth asks all node types to move to v2.10.0, and Base operators to v1.5.3. Until then, the risk Blockaid described stays with nodes that have not upgraded.

Sources

• Unchained, 5 Nov 2026

AI wrote this summary from the primary documents and reports cited above. It went live automatically after checks that figures match those sources and nothing is copied; there was no human review. It explains a protocol or rule change and is not investment advice.