Base Confirms Users Unaffected by Reth State Root Bug, Releases v1.5.3 Fix
Base has confirmed that its network users were not affected by a software bug in Reth, an Ethereum execution client used by the Layer 2 network. The issue could cause certain nodes to calculate an incorrect blockchain state root, potentially creating problems for validators and applications that depend on accurate state verification.
Base responded by patching its block builders and releasing node software v1.5.3. The network also recomputed its state root and confirmed that the existing chain state was correct. Node operators were advised to install the update, with no resynchronization required.
The incident also prompted precautionary measures across parts of the decentralized finance ecosystem, including temporary restrictions on some cross-chain routes.
Base Verifies Its Blockchain State Remains Correct
Base disclosed the issue in a November 5 status update, explaining that a bug discovered in Reth on November 4 could cause nodes to calculate an incorrect state root under certain conditions. A state root is a cryptographic hash that represents the current state of a blockchain, including account balances and smart contract storage.
An incorrect state root can create inconsistencies between a node's calculated state and the expected blockchain state. This can affect validation and the reliability of state proofs returned to applications. Base said it investigated the issue and independently recomputed its current state root to confirm that it was correct.
“We’ve verified the current state root is correct and users were not affected,” Base stated in its official incident update. The network also explained that its proof system checks every state root using an independent implementation, providing an additional verification layer that would have detected a mismatch.
Base said it patched all its block builders on November 4, the day the issue was identified. This measure was intended to prevent newly produced blocks from being affected by the problem.
Base Releases v1.5.3 and Reth Ships v2.10.0
The response included a software update for Base node operators. Base released v1.5.3, which addresses the state root mismatch risk and prevents validators from halting when they encounter an invalid state root.
The Base v1.5.3 release notes identify the state root mismatch fix as one of the main changes. The release recommends that operators upgrade their Base Mainnet and Base Sepolia nodes at their earliest convenience. It does not introduce any listed breaking changes.
Base specifically stated that operators do not need to resynchronize their nodes or take additional recovery steps after installing the update. The software release is intended to remove the validator halt risk associated with the issue.
The upstream execution client also received an update. Reth's maintainers released v2.10.0, a high-priority release for both payload-building and non-payload-building nodes. Its release notes include a fix involving the trie iterator's seek behavior at cached branch boundaries.
The relevant upstream change was merged through Reth pull request #28264 on November 3, 2026. The change tightened the iterator's seek decision and added a regression test for incremental state-root calculations. The Reth v2.10.0 release lists the update among its engine and trie fixes.
DeFi Protocols Take Precautionary Measures
The issue also raised concerns for applications and services operating across networks that use Reth or its OP Stack variant, op-reth. Cross-chain systems depend on reliable transaction processing and state verification, making client-level inconsistencies relevant beyond the network running the affected software.
Frax Finance addressed the situation in a November 5 post, stating that LayerZero had temporarily paused certain cross-chain routes as a precaution. Frax said its assets and smart contracts were not affected and indicated that the routes were expected to resume soon. The protocol's statement can be viewed in its announcement.
The incident also led to reported risk-management measures involving Gauntlet's V1 vaults. The reported steps included restricting new deposits, pausing allocations, and reducing exposure to LayerZero-bridged assets. These measures were described as precautions rather than evidence of a confirmed loss of funds. However, Gauntlet's original post detailing the measures was subsequently deleted, so the specific operational status should be treated cautiously.
These responses illustrate how a potential execution-client issue can affect DeFi operations even when a particular protocol has not identified direct damage to its own assets or contracts.
No Confirmed Exploit Linked to the Bug
The distinction between a software correctness issue and an active attack is important. The available information describes a problem in how certain nodes calculate blockchain state, rather than a confirmed exploit involving stolen funds.
Security firm Blockaid characterized the issue as a client calculation bug and warned that nodes running affected software could experience synchronization problems or return incorrect state proofs. The warning also emphasized the importance of upgrading affected infrastructure. No confirmed fund losses or exploit linked to this specific bug were identified in the supplied incident information. Blockaid's warning was circulated in its security alert.
The potential consequences nevertheless make the issue significant for infrastructure providers. Incorrect state proofs can affect systems that rely on nodes to verify account balances, contract storage, and other blockchain data. Nodes that continue using affected software may therefore create reliability problems for applications and services that depend on their responses.
The incident is separate from the earlier $292 million Kelp DAO rsETH bridge exploit, which LayerZero linked to North Korea's Lazarus Group. No established connection has been identified between that attack and the Reth state root bug.
What Node Operators and DeFi Users Should Know
For Base infrastructure operators, the immediate action is to upgrade to v1.5.3. Base has said that the update removes the identified validator halt risk and does not require a full node resynchronization. Operators running other Reth-based or OP Stack infrastructure should also check the applicable software release and upgrade guidance for their network.
For DeFi users, the incident highlights why temporary route restrictions or deposit limitations can occur even when a protocol reports no direct impact. Such measures can be part of an infrastructure risk response while developers and service providers verify that their systems are operating correctly.
Base's confirmation that its state root is correct provides reassurance about the network's existing state. However, the broader incident underscores the importance of maintaining updated execution clients and independently checking blockchain data. The coordinated fixes from Base and Reth address the identified software issue, while affected infrastructure providers must ensure they are running compatible patched versions.
