Reth trie bug can omit new state entries; upstream and downstream fixes are available
Reth's trie iterator could compute an incorrect incremental state root. Upstream 2.10.0, Base 1.5.3, op-reth 2.8.1, Morph 1.4.1 and BNB reth-bsc 0.1.4-hotfix contain fixes. Celo, Mantle and Gravity have scoped source backports; other release coverage and full ranges need verification. No exploitation or fund loss is established.
- Disclosed
- Nov 3, 2026
- Updated Nov 6, 2026
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Nodes and applications using an affected Reth trie implementation; exposure depends on the actual fork and pinned revision.
- Reth · Ethereum · integrity
- In the wild
- Unknown
- No exploitation or fund loss is established in the reviewed original fix records.
What happened
The iterator combines stored trie branches with newly hashed state entries. Its previous shortcut could skip a seek when the stored branch was deeper than the seek prefix, leaving a newly inserted leaf out of the incremental root. The patch permits that shortcut only when the keys are equal. The upstream regression test and Celo’s backport explanation describe this concrete correctness failure.
Reth 2.10.0 lists PR 28264, and Base 1.5.3 explicitly says it prevents a state-root mismatch through that same patch. Celo and Mantle published narrower backports tied to their own dependency pins. A merged backport does not establish that every deployed node or every branch already runs it. The op-reth 2.8.1 tag also contains the backport: its release commit merges PR 23924 and rust/Cargo.lock pins the corrected fork revision. Its release notes only mention an unrelated RPC correction, so those notes alone would miss this fix. Full vulnerable-version ranges and other downstream packaged-release thresholds remain incomplete.
L3 reflects an integrity bug in a widely used execution-client family and an actionable operator update. These original records do not establish an attacker stealing assets, remote code execution, a chain-wide compromise or confirmed user losses. Claims about paused bridges or incorrect proof responses require their own original evidence and are not used to expand the verified scope here.
November 6 BNB backports: BNB Reth merged the upstream-equivalent correction on main and separately on its v2.8 integration branch. Verify the actual fork/commit in the deployed artifact; a merged source patch is not evidence of a released build or fleet-wide deployment. These technical records do not establish a chain-wide incident, confirmed user loss or the extent of BNB Chain exposure.
November 6 Morph and Gravity follow-up: Morph’s released morph-reth 1.4.1 hotfix uses upstream Reth 2.5.2 plus the trie fix through morph-l2/reth v2.5.2-morph.1, avoiding an immediate full upstream upgrade. Its release requires upgrading every node, including followers, without a database migration or resync. Gravity separately merged its equivalent correction on main; no fixed Gravity release number was established. These records expand patch coverage, not evidence of theft or a chain-wide compromise.
BNB released hotfix: The node release reth-bsc v0.1.4-hotfix now provides a released node remediation, beyond the earlier source merges. Its dependency tag bnb-chain/reth v0.1.4 is marked prerelease; those are separate repositories and version contexts. Follow the hotfix instructions for the actual reth-bsc deployment. This does not establish that every BNB client uses the affected code, that the separate v2.8 branch has a released fix, or that exploitation occurred.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Upstream Reth | 2.10.0 | Contains the trie fix; use a build compatible with the operated chain |
| OP Stack op-reth | 2.8.1 | Tagged lockfile contains op-v2.6.0-2 backport; release notes mention only a separate RPC fix |
| Base Mainnet and Sepolia node release | 1.5.3 | Base recommends upgrading; release notes explicitly link the state-root fix |
| Morph morph-reth | 1.4.1 | Released hotfix; pins morph-l2/reth v2.5.2-morph.1 with the upstream-equivalent fix |
| BNB reth-bsc | 0.1.4-hotfix | Released hotfix pins bnb-chain/reth v0.1.4; upgrade and restart, no database migration or hardfork for this fix |
Crime-scene timeline
Nov 3, 21:00 UTC
Upstream merges the iterator-boundary fix
PR 28264 merges as 8572c88 and includes an incremental-root regression test.
Nov 5, 2026
Celo and Mantle merge scoped backports
Celo updates its celo/reth-v1.0 fork pin; Mantle backports onto its production mantle-v1.6.2 line. Other branches require separate verification.
Nov 5, 2026
Reth 2.10.0, op-reth 2.8.1 and Base 1.5.3 contain the fix
Upstream lists the trie correction; the op-reth release tag pins its backport despite RPC-only release notes. Base recommends its new build for Mainnet and Sepolia and links the same fix.
Nov 6, 02:19 UTC
BNB Reth merges its main-line backport
PR 254 merges as 3b2bd020; it backports the same upstream iterator correction and regression test.
Nov 6, 02:20 UTC
BNB publishes the patched Reth dependency tag
bnb-chain/reth v0.1.4 includes PR 254; this dependency tag is marked prerelease.
Nov 6, 02:40 UTC
BNB Reth merges a separate v2.8 integration backport
PR 255 merges as 141cc278 into fix/bsc-static-file-td-611. This establishes a branch-specific patch, not a released safe-version threshold.
Nov 6, 02:53 UTC
BNB releases reth-bsc 0.1.4-hotfix
The released node hotfix pins reth v0.1.4 and recommends an immediate upgrade for all reth-bsc mainnet/testnet node operators. Install and restart; this fix needs no database migration or hardfork.
Nov 6, 2026
Morph releases morph-reth 1.4.1
The hotfix pins the corrected fork and adds a regression test. All Morph nodes, including followers, should upgrade; no database migration or resync is required.
Nov 6, 2026
Gravity merges a source backport
PR 464 merges as c407bd9 into main. This is a verified source patch, not a released safe-version threshold.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Reth original fix PRPrimaryPublic November3 iterator-boundary correction and regression test; merged as 8572c88.
- Reth fix PR APIPrimaryRecords public creation and November3 21:00:09 UTC merge time.
- Reth 2.10.0 releasePrimaryNovember5 release lists the trie seek-boundary fix and publishes artifact-signing information.
- Base 1.5.3 releasePrimaryExplicitly links Reth PR28264, recommends upgrading Base Mainnet and Sepolia, and names no deadline.
- Celo original backport PR APIPrimaryExplains omitted-leaf mechanism, fork pin, regression checks and the separate main-branch follow-up; HTML retrieval returned a shell.
- Mantle original backport PRPrimaryDocuments the affected pinned revision and production-line backport; development branches need separate work.
- OP Stack op-reth 2.8.1 release notesPrimaryDescribes an eth_capabilities correction; trie-fix inclusion is independently established by the tagged lockfile and original backport records.
- OP Stack dependency backport PR APIPrimaryMerged November5 as 7220729, the op-reth2.8.1 release commit; pins fork tag op-v2.6.0-2.
- OP Reth original trie backport APIPrimaryBackports upstream8572c88 as 3c5f2f11, with only a test-import adjustment.
- op-reth 2.8.1 tagged dependency lockfilePrimaryThe published tag pins reth-trie to op-v2.6.0-2 and commit3c5f2f11c4e5a5647e6e911cd131ccf1bada4f25.
- BNB Reth main backport PR APIPrimaryNovember 6 02:19:15 UTC merge 3b2bd020 into main; same upstream correction and regression test.
- BNB Reth v2.8 integration backport APIPrimaryNovember 6 02:40:58 UTC merge 141cc278 into fix/bsc-static-file-td-611; separate branch integration, not a packaged release.
- Morph morph-reth 1.4.1 releasePrimaryReleased trie hotfix, corrected fork pin, all-node upgrade, artifacts and rolling-restart guidance.
- Morph original hotfix PR 228PrimaryExplains exact pinned fork, serial-path exposure, regression test and pre-rollout validation.
- Gravity original backport PR 464PrimaryMerged upstream-equivalent correction as c407bd9 into main on November 6; no packaged safe version established.
- BNB Reth dependency v0.1.4 releasePrimaryPrerelease dependency tag includes PR 254 / 3b2bd02; GitHub’s UTC timestamp dates publication to November 6 02:20:56 UTC.
- BNB reth-bsc 0.1.4-hotfix releasePrimaryReleased node hotfix pins reth v0.1.4; all mainnet/testnet reth-bsc operators should upgrade and restart, without database migration or hardfork for this fix. GitHub’s UTC timestamp gives November 6 02:53:35 UTC.