Reth Bug Prompts Precautionary Pause of Some LayerZero Routes, With No Known Losses
Key Facts
A software bug in the Reth client led to a precautionary pause of some LayerZero routes, according to a report that said the issue was addressed at the software level; there is no statement confirming that all LayerZero services stopped. Base said the bug was discovered on November 4, 2026, and could cause a node in some cases to calculate an incorrect state root. A state root is a representation of the network's state that nodes rely on to verify its data. Blockaid described the issue as a software correctness bug, not a security exploit. Blockaid also said there were no known financial losses caused by the bug.
The operational risk lies with nodes that have not received the update; they could stop syncing or return incorrect state proofs, according to Blockaid. This puts the accuracy of the state displayed by nodes in focus for network operators and RPC providers, which give applications access to their data. This possibility distinguishes a state-calculation bug from an attack aimed at draining assets, as Blockaid's description of the issue emphasized. The report cited no known financial losses linked to it. At the same time, this alone does not establish that all routes or services connected to LayerZero stopped.
Base said it recalculated the state root and confirmed it was correct, adding that users were unaffected. It said its proving system checks every state root through an independent execution, which would have detected any discrepancy. This means Base has a verification mechanism separate from the node's own calculation to review the root. The company also said it updated all block-building nodes that same day to prevent new blocks from being affected. Its stated response therefore combined a review of the result with an update to the infrastructure that produces blocks.
For versions, Blockaid identified the patched releases as Reth v2.10.0, op-reth v2.8.1 and Base node-reth v1.5.3. Reth's release notes say v2.10.0 is a security-hardening release and includes a fix to the search decision in the trie structure at cached branch boundaries. The notes also described the upgrade priority as high for node operators. These releases apply to different clients, so the update depends on which client each operator runs, according to the list published by Blockaid. Blockaid urged node operators and RPC providers to upgrade and verify that service providers had installed the update.
Base recommended that node operators upgrade to v1.5.3, saying the update removes the risk of a halt it described. It added that resynchronization or further action was not required after upgrading. Base's page shows that it addressed block-building nodes on the day the bug was discovered, while its recommendation to operators remained focused on the patched release. In Reth development, GitHub records show that fix pull request 28264 was merged on November 3, 2026, a day before Base's discovery date for the bug. These dates provide context for the sequence of the fix being merged, the issue being discovered and the patched releases being announced on November 5, 2026.