{
  "id": "reth-state-root",
  "url": "https://ohshit.app/incidents/reth-state-root/",
  "title": "Reth trie bug can omit new state entries; upstream and downstream fixes are available",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-03",
  "date_is_approximate": false,
  "updated": "2026-11-06",
  "tags": [
    "Reth",
    "Ethereum",
    "integrity"
  ],
  "ecosystems": [],
  "summary": "Reth's trie iterator could compute an incorrect incremental state root. Upstream 2.10.0, Base 1.5.3, op-reth 2.8.1, Morph 1.4.1 and BNB reth-bsc 0.1.4-hotfix contain fixes. Celo, Mantle and Gravity have scoped source backports; other release coverage and full ranges need verification. No exploitation or fund loss is established.",
  "splash": "Nodes and applications using an affected Reth trie implementation; exposure depends on the actual fork and pinned revision.",
  "wipe": "Upgrade to a chain-compatible build containing Reth fix 8572c88; verify downstream pins and validate node state after restarting.",
  "in_the_wild": "unknown",
  "source_exception": null,
  "cves": [],
  "fixed": [
    {
      "product": "Upstream Reth",
      "version": "2.10.0",
      "status": "Contains the trie fix; use a build compatible with the operated chain"
    },
    {
      "product": "OP Stack op-reth",
      "version": "2.8.1",
      "status": "Tagged lockfile contains op-v2.6.0-2 backport; release notes mention only a separate RPC fix"
    },
    {
      "product": "Base Mainnet and Sepolia node release",
      "version": "1.5.3",
      "status": "Base recommends upgrading; release notes explicitly link the state-root fix"
    },
    {
      "product": "Morph morph-reth",
      "version": "1.4.1",
      "status": "Released hotfix; pins morph-l2/reth v2.5.2-morph.1 with the upstream-equivalent fix"
    },
    {
      "product": "BNB reth-bsc",
      "version": "0.1.4-hotfix",
      "status": "Released hotfix pins bnb-chain/reth v0.1.4; upgrade and restart, no database migration or hardfork for this fix"
    }
  ],
  "checklist": [
    {
      "title": "Identify the client and the actual Reth revision",
      "hint": "Inventory the running binary or container, chain, fork, image digest and dependency lockfile. Look for upstream merge 8572c88fe04fb2213d86f020ed9e72e612abb097 or the vendor's equivalent backport. A version from another fork is not a reliable threshold; the complete affected range is not established here."
    },
    {
      "title": "Install the matching released fix and restart the node",
      "hint": "Use official upstream Reth 2.10.0 or the Base 1.5.3 release as appropriate. Upstream rates the release high priority for builders and non-builders; Base covers Mainnet and Sepolia and gives no deadline. OP Stack operators can use op-reth 2.8.1, whose tagged lockfile includes the backport. Verify published artifacts and signatures before replacing the binary or image, then confirm the running version after restart. Reth publishes signing fingerprint 50FB 7CC5 5B2E 8AFA 59FE 03B7 AA5E D56A 7FBF 253E."
    },
    {
      "title": "Confirm Celo, Mantle and OP Stack backport coverage",
      "hint": "Celo PR 369 moves celo/reth-v1.0 to reth pin 74cc8bbce7631c3586ab446460590fef6630d258; it says main needs a separate cherry-pick. Mantle PR 237 targets production mantle-v1.6.2 and identifies dev/mantle-v1.6.3 and dev/mantle-v1.7.0 for follow-up. Ask each vendor for a released build carrying its patch. For op-reth 2.8.1, rust/Cargo.lock pins reth-trie to op-v2.6.0-2 / 3c5f2f11c4e5a5647e6e911cd131ccf1bada4f25, the upstream-equivalent backport. PR 23924 and the release tag confirm inclusion even though its notes mention only eth_capabilities. Verify the running artifact, not just the release-note wording."
    },
    {
      "title": "Check node integrity before relying on its responses",
      "hint": "Preserve mismatch logs, affected block numbers and build identifiers. As a defensive validation step, compare synchronization and affected state roots against an independently trusted, patched provider; investigate persistent mismatches through the chain's official recovery procedure. The reviewed fix records do not prescribe a universal database deletion or resync procedure. Protocol and RPC operators should verify their own providers' build coverage before relying on state data."
    },
    {
      "title": "Install the BNB reth-bsc hotfix and distinguish other patch lines",
      "hint": "For reth-bsc on BSC mainnet or testnet, install the official v0.1.4-hotfix and restart; the vendor includes validators, MEV builders, full nodes and sentries. This fix requires no database migration or hardfork. Confirm the running artifact uses bnb-chain/reth v0.1.4 (PR 254 / 3b2bd02006ef8970c862d2af5dbc98a92f58d57d); that dependency tag itself is a prerelease, distinct from the released reth-bsc hotfix. The separate v2.8 integration backport PR 255 / 141cc278068cb60d1045957709ad88d7bfdbed1f remains branch-specific: do not treat 0.1.4-hotfix as a universal safe version for every BNB Reth fork. Verify inherited release requirements when upgrading older nodes; the no-hardfork statement concerns this correction, not unrelated protocol upgrades."
    },
    {
      "title": "Roll out the Morph 1.4.1 hotfix across every node",
      "hint": "Use the official v1.4.1 binaries or ghcr.io/morph-l2/morph-reth:v1.4.1, followers included. The release retains the database format, flags, RPC and chain configuration; perform a rolling restart, with no migration or resync. Rollback means restoring the prior binary. Source builders must allow or mirror morph-l2/reth tag v2.5.2-morph.1, replacing the upstream source. The PR recommends testing a Hoodi follower with --engine.state-root-fallback and a layer1-mode validator before rollout. No matching morph-geth release is required."
    },
    {
      "title": "Verify Gravity source coverage separately from release availability",
      "hint": "Gravity PR 464 merged c407bd9 into main, backporting upstream 8572c88 and its regression test. Match the actual deployed revision and obtain the supported artifact from Gravity; do not infer a packaged fixed version or fleet-wide deployment from the source merge alone."
    }
  ],
  "sources": [
    {
      "name": "Reth original fix PR",
      "url": "https://github.com/paradigmxyz/reth/pull/28264",
      "says": "Public November3 iterator-boundary correction and regression test; merged as 8572c88.",
      "primary": true
    },
    {
      "name": "Reth fix PR API",
      "url": "https://api.github.com/repos/paradigmxyz/reth/pulls/28264",
      "says": "Records public creation and November3 21:00:09 UTC merge time.",
      "primary": true
    },
    {
      "name": "Reth 2.10.0 release",
      "url": "https://github.com/paradigmxyz/reth/releases/tag/v2.10.0",
      "says": "November5 release lists the trie seek-boundary fix and publishes artifact-signing information.",
      "primary": true
    },
    {
      "name": "Base 1.5.3 release",
      "url": "https://github.com/base/base/releases/tag/v1.5.3",
      "says": "Explicitly links Reth PR28264, recommends upgrading Base Mainnet and Sepolia, and names no deadline.",
      "primary": true
    },
    {
      "name": "Celo original backport PR API",
      "url": "https://api.github.com/repos/celo-org/celo-kona/pulls/369",
      "says": "Explains omitted-leaf mechanism, fork pin, regression checks and the separate main-branch follow-up; HTML retrieval returned a shell.",
      "primary": true
    },
    {
      "name": "Mantle original backport PR",
      "url": "https://github.com/mantle-xyz/reth/pull/237",
      "says": "Documents the affected pinned revision and production-line backport; development branches need separate work.",
      "primary": true
    },
    {
      "name": "OP Stack op-reth 2.8.1 release notes",
      "url": "https://github.com/ethereum-optimism/optimism/releases/tag/op-reth%2Fv2.8.1",
      "says": "Describes an eth_capabilities correction; trie-fix inclusion is independently established by the tagged lockfile and original backport records.",
      "primary": true
    },
    {
      "name": "OP Stack dependency backport PR API",
      "url": "https://api.github.com/repos/ethereum-optimism/optimism/pulls/23924",
      "says": "Merged November5 as 7220729, the op-reth2.8.1 release commit; pins fork tag op-v2.6.0-2.",
      "primary": true
    },
    {
      "name": "OP Reth original trie backport API",
      "url": "https://api.github.com/repos/ethereum-optimism/reth/pulls/32",
      "says": "Backports upstream8572c88 as 3c5f2f11, with only a test-import adjustment.",
      "primary": true
    },
    {
      "name": "op-reth 2.8.1 tagged dependency lockfile",
      "url": "https://raw.githubusercontent.com/ethereum-optimism/optimism/op-reth/v2.8.1/rust/Cargo.lock",
      "says": "The published tag pins reth-trie to op-v2.6.0-2 and commit3c5f2f11c4e5a5647e6e911cd131ccf1bada4f25.",
      "primary": true
    },
    {
      "name": "BNB Reth main backport PR API",
      "url": "https://api.github.com/repos/bnb-chain/reth/pulls/254",
      "says": "November 6 02:19:15 UTC merge 3b2bd020 into main; same upstream correction and regression test.",
      "primary": true
    },
    {
      "name": "BNB Reth v2.8 integration backport API",
      "url": "https://api.github.com/repos/bnb-chain/reth/pulls/255",
      "says": "November 6 02:40:58 UTC merge 141cc278 into fix/bsc-static-file-td-611; separate branch integration, not a packaged release.",
      "primary": true
    },
    {
      "name": "Morph morph-reth 1.4.1 release",
      "url": "https://github.com/morph-l2/morph-reth/releases/tag/v1.4.1",
      "says": "Released trie hotfix, corrected fork pin, all-node upgrade, artifacts and rolling-restart guidance.",
      "primary": true
    },
    {
      "name": "Morph original hotfix PR 228",
      "url": "https://github.com/morph-l2/morph-reth/pull/228",
      "says": "Explains exact pinned fork, serial-path exposure, regression test and pre-rollout validation.",
      "primary": true
    },
    {
      "name": "Gravity original backport PR 464",
      "url": "https://github.com/Galxe/gravity-reth/pull/464",
      "says": "Merged upstream-equivalent correction as c407bd9 into main on November 6; no packaged safe version established.",
      "primary": true
    },
    {
      "name": "BNB Reth dependency v0.1.4 release",
      "url": "https://github.com/bnb-chain/reth/releases/tag/v0.1.4",
      "says": "Prerelease dependency tag includes PR 254 / 3b2bd02; GitHub’s UTC timestamp dates publication to November 6 02:20:56 UTC.",
      "primary": true
    },
    {
      "name": "BNB reth-bsc 0.1.4-hotfix release",
      "url": "https://github.com/bnb-chain/reth-bsc/releases/tag/v0.1.4-hotfix",
      "says": "Released node hotfix pins reth v0.1.4; all mainnet/testnet reth-bsc operators should upgrade and restart, without database migration or hardfork for this fix. GitHub’s UTC timestamp gives November 6 02:53:35 UTC.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "No exploitation or fund loss is established in the reviewed original fix records.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 3, 21:00 UTC",
      "title": "Upstream merges the iterator-boundary fix",
      "body": "PR 28264 merges as 8572c88 and includes an incremental-root regression test."
    },
    {
      "date": "Nov 5, 2026",
      "title": "Celo and Mantle merge scoped backports",
      "body": "Celo updates its celo/reth-v1.0 fork pin; Mantle backports onto its production mantle-v1.6.2 line. Other branches require separate verification."
    },
    {
      "date": "Nov 5, 2026",
      "title": "Reth 2.10.0, op-reth 2.8.1 and Base 1.5.3 contain the fix",
      "body": "Upstream lists the trie correction; the op-reth release tag pins its backport despite RPC-only release notes. Base recommends its new build for Mainnet and Sepolia and links the same fix."
    },
    {
      "date": "Nov 6, 02:19 UTC",
      "title": "BNB Reth merges its main-line backport",
      "body": "PR 254 merges as 3b2bd020; it backports the same upstream iterator correction and regression test."
    },
    {
      "date": "Nov 6, 02:20 UTC",
      "title": "BNB publishes the patched Reth dependency tag",
      "body": "bnb-chain/reth v0.1.4 includes PR 254; this dependency tag is marked prerelease."
    },
    {
      "date": "Nov 6, 02:40 UTC",
      "title": "BNB Reth merges a separate v2.8 integration backport",
      "body": "PR 255 merges as 141cc278 into fix/bsc-static-file-td-611. This establishes a branch-specific patch, not a released safe-version threshold."
    },
    {
      "date": "Nov 6, 02:53 UTC",
      "title": "BNB releases reth-bsc 0.1.4-hotfix",
      "body": "The released node hotfix pins reth v0.1.4 and recommends an immediate upgrade for all reth-bsc mainnet/testnet node operators. Install and restart; this fix needs no database migration or hardfork."
    },
    {
      "date": "Nov 6, 2026",
      "title": "Morph releases morph-reth 1.4.1",
      "body": "The hotfix pins the corrected fork and adds a regression test. All Morph nodes, including followers, should upgrade; no database migration or resync is required."
    },
    {
      "date": "Nov 6, 2026",
      "title": "Gravity merges a source backport",
      "body": "PR 464 merges as c407bd9 into main. This is a verified source patch, not a released safe-version threshold."
    }
  ],
  "body_markdown": "The iterator combines stored trie branches with newly hashed state entries. Its previous shortcut could skip a seek when the stored branch was deeper than the seek prefix, leaving a newly inserted leaf out of the incremental root. The patch permits that shortcut only when the keys are equal. The upstream regression test and Celo's backport explanation describe this concrete correctness failure.\n\nReth 2.10.0 lists PR 28264, and Base 1.5.3 explicitly says it prevents a state-root mismatch through that same patch. Celo and Mantle published narrower backports tied to their own dependency pins. A merged backport does not establish that every deployed node or every branch already runs it. The op-reth 2.8.1 tag also contains the backport: its release commit merges PR 23924 and rust/Cargo.lock pins the corrected fork revision. Its release notes only mention an unrelated RPC correction, so those notes alone would miss this fix. Full vulnerable-version ranges and other downstream packaged-release thresholds remain incomplete.\n\nL3 reflects an integrity bug in a widely used execution-client family and an actionable operator update. These original records do not establish an attacker stealing assets, remote code execution, a chain-wide compromise or confirmed user losses. Claims about paused bridges or incorrect proof responses require their own original evidence and are not used to expand the verified scope here.\n\n**November 6 BNB backports:** BNB Reth merged the upstream-equivalent correction on main and separately on its v2.8 integration branch. Verify the actual fork/commit in the deployed artifact; a merged source patch is not evidence of a released build or fleet-wide deployment. These technical records do not establish a chain-wide incident, confirmed user loss or the extent of BNB Chain exposure.\n\n**November 6 Morph and Gravity follow-up:** Morph’s released morph-reth 1.4.1 hotfix uses upstream Reth 2.5.2 plus the trie fix through morph-l2/reth v2.5.2-morph.1, avoiding an immediate full upstream upgrade. Its release requires upgrading every node, including followers, without a database migration or resync. Gravity separately merged its equivalent correction on main; no fixed Gravity release number was established. These records expand patch coverage, not evidence of theft or a chain-wide compromise.\n\n**BNB released hotfix:** The node release `reth-bsc v0.1.4-hotfix` now provides a released node remediation, beyond the earlier source merges. Its dependency tag `bnb-chain/reth v0.1.4` is marked prerelease; those are separate repositories and version contexts. Follow the hotfix instructions for the actual reth-bsc deployment. This does not establish that every BNB client uses the affected code, that the separate v2.8 branch has a released fix, or that exploitation occurred."
}