Paradigm says a bug in Reth could produce incorrect blockchain state calculations, prompting coordinated patches across major Ethereum infrastructure.

A software flaw that could allow specially crafted transactions to produce incorrect blockchain state calculations has prompted coordinated fixes across Ethereum infrastructure.

On Nov. 5, Georgios Konstantopoulos, chief technology officer at crypto investment firm Paradigm, said that developers had released patches for Reth, Optimism, Base and Tempo after discovering an error in software used to process blockchain transactions.

The vulnerability affected Reth, an Ethereum execution client developed by Paradigm that provides critical infrastructure for networks operating within the Ethereum Virtual Machine (EVM) ecosystem.

According to Konstantopoulos, the flaw originated in Reth's legacy state-root calculation system, which could return an incorrect result when processing certain smart contract storage configurations.

A state root is a cryptographic fingerprint representing a blockchain's current state, including account balances and smart contract data. An incorrect calculation can cause nodes to disagree about the validity of a block, potentially disrupting transaction processing or network synchronization.

“Reth's legacy state root code had an edge case,” Konstantopoulos explained, adding that a carefully crafted transaction could trigger the error under specific conditions.

Reth's block-building software used the vulnerable calculation method on lower-end hardware and in networks built with Optimism's OP Stack, extending the potential exposure beyond Ethereum's mainnet infrastructure.

The Tempo development team discovered the issue through automated security testing. The testing technique, known as fuzzing, involves feeding software unusual or unexpected inputs to uncover errors that ordinary testing might miss.

Source link