Base said in a status notice Thursday that its users were not affected by a bug in Reth, the execution client the chain is built on, that could in some cases leave a node with the wrong state root, the single hash that summarizes a blockchain’s entire state. Reth’s maintainers listed the fix in v2.10.0 and rated the upgrade high priority for both payload-building and non-payload-building nodes.
Base released node version v1.5.3, which it says removes the risk of Base validators halting on an invalid state root, and told operators they don’t need to resync.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What Base Confirmed
Base said it recomputed the chain’s state root and confirmed it was correct. “We’ve verified the current state root is correct and users were not affected,” Base wrote. Its proof system checks every state root with a separate implementation and would have flagged a mismatch, the notice said.
Base says the bug was discovered on Nov. 4 and that it patched all of its block builders the same day. The upstream fix, pull request #28264, was merged into Reth’s code a day earlier, on Nov. 3 at 21:00 UTC, about 43 hours before Base posted its notice, by Unchained’s count of the GitHub and Base status timestamps.
Precautions in DeFi
Frax Finance said in a post that LayerZero “has temporarily paused certain cross-chain routes as a precaution and should resume soon.” Frax tied the post to a reported incident in op-reth, the OP Stack build of Reth, and said none of its assets or smart contracts were affected.
The Defiant reported earlier Thursday, citing Gauntlet, that the risk manager had restricted new deposits into its V1 vaults without halting withdrawals after a reported op-reth vulnerability. Gauntlet had also paused allocations and was reducing its exposure to LayerZero-bridged assets, according to The Defiant’s report, and said it knew of no reported exploit. Gauntlet’s X post on the measures has since been deleted.
No Exploit Reported
Security firm Blockaid said the flaw was a bug in how nodes calculate results, not an attack, and that no fund losses were known, according to a KuCoin summary of its posts. Blockaid warned that nodes still running the old code could freeze up or return faulty state proofs, the summary said.
The route pauses Frax described come more than six months after a $292 million exploit of Kelp DAO’s rsETH bridge, which LayerZero linked to North Korea’s Lazarus Group. No source has tied the Reth bug to any exploit.
Related Listen: Who’s to Blame for How KelpDAO’s DVN Was Set Up? KelpDAO or LayerZero?
