BNB Chain and Base have responded to a security bug in Reth, an Ethereum execution client used directly or in modified form across several EVM-compatible networks. The flaw could make affected nodes calculate an incorrect blockchain state root, raising concerns about synchronization and state verification.
Base said it identified the issue on November 4 and patched its block-building nodes the same day. BNB Chain said opBNB does not use op-reth, while its exposure through BSC-Reth is limited; developers were preparing a hotfix.
What the Reth bug affects
A blockchain state root is a cryptographic value that represents the network’s current accounts, balances, and smart-contract storage. If a node calculates it incorrectly, it may disagree with the rest of the network about the true state of the chain.
That can create two main problems: affected nodes may fail to synchronize properly, and applications relying on state proofs could receive unreliable information. Security firm Blockaid said unpatched clients could experience synchronization issues or return incorrect proofs through the eth_getProof interface.
Blockaid described the issue as a software correctness bug, not a confirmed exploit. It also reported no known financial losses connected to the flaw.
Base says users were not affected
Base, the Coinbase-backed layer 2 network, uses Reth as part of its execution infrastructure. After discovering the vulnerability on November 4, its team applied a mitigation and patched all block-building nodes on the same day.
The team then recalculated the network’s state root and confirmed it matched the correct value. Base said its proof system independently verifies every state root, adding another layer of protection against inconsistent calculations.
Base released version 1.5.3 to prevent validators from halting when they encounter invalid state roots. Node operators were told to upgrade promptly, but the network said they did not need to resynchronize nodes or take additional recovery steps.
Base’s November 5 status notice listed a maintenance window through November 7 at 16:19 UTC. The public patch became available at 17:52 UTC on November 5.
BNB Chain assesses limited exposure
BNB Chain issued its own notice on November 6 after the Reth security risk became public. The team said opBNB does not use op-reth, so that network was not affected through that client.
However, BNB Chain acknowledged limited exposure for BSC-Reth. Its developers were actively preparing a hotfix and monitoring the situation to protect network security.
At the time of the announcement, BNB Chain said no action was required from developers or users. The team’s response focused on preventing the bug from creating state inconsistencies or service disruptions.
Reth developers shipped a fix
The underlying problem involved how certain Reth versions calculate the state root. Reth is an Ethereum execution client developed by Paradigm and is used directly or through modified versions by several blockchain networks.
A GitHub change merged on November 3 addressed an error in the client’s trie iterator, which handles cached branch boundaries when searching stored blockchain data. The fix changed that behavior and added a regression test for incremental state-root calculations.
Reth developers included the correction in version 2.10.0. Patched related releases included op-reth 2.8.1 and Base’s 1.5.3 software update.
Cross-chain services take precautions
The bug also affected services that depend on accurate blockchain state verification. Cross-chain interoperability provider LayerZero temporarily suspended some off-chain infrastructure connected to affected networks while fixes were being deployed.
The restrictions delayed certain cross-chain messages, but reports said the messages would not be lost. Some decentralized finance services also temporarily limited deposits or cross-chain routing while operators reviewed their exposure.
LayerZero provides interoperability infrastructure used by many blockchain applications. In September, Anchorage Digital chose LayerZero to support cross-chain transfers for stablecoins issued through its federally chartered bank, with Tether’s USAT named as the first stablecoin to use its Omnichain Fungible Token standard.
Why this matters for EVM networks
The incident shows how a bug in one execution client can affect multiple blockchain ecosystems. EVM networks often share software components, so a flaw in a client such as Reth can create risks beyond Ethereum itself.
It also highlights the value of independent verification systems. Base’s ability to recalculate and confirm its state root helped it confirm that users were unaffected, while LayerZero’s temporary restrictions show how infrastructure providers can reduce risk during a security response.
For node operators, the key action is simple: upgrade affected Reth-based software immediately. Base recommends version 1.5.3, while BNB Chain continues work on its BSC-Reth hotfix.
