BNB Smart Chain (BSC) has released a hotfix to its Reth execution client, BSC-Reth, according to the official announcement and a patch on Github. The patch addresses a vulnerability discovered on November 4, 2026, which could result in incorrect blockchain state-root calculations due to a bug in the legacy trie code (used to organize blockchain data).
Although the vulnerability could have resulted in financial loss, there is no evidence that the vulnerability was exploited or that funds were affected.
What Is the Reth Vulnerability?
Rust Ethereum Harvester Tree, also known as Reth, is an execution client used to verify the data on the blockchain and process transactions. On November 4, 2026, a vulnerability was discovered in certain versions of Reth that could result in incorrect state-root calculations due to a bug in the legacy trie code.
This could potentially result in node disagreements and sync failures. The underlying bug was fixed in Reth pull request #28264, merged on November 3.
What Does BSC's v0.1.4-hotfix Change?
On November 6, BNB Chain published BSC-Reth v0.1.4-hotfix on GitHub. According to the release notes, this version includes a fix for incorrect state-root calculation in the legacy path in Reth. This version of BSC-Reth improves the way it deals with blockchain data, reducing the risk of incorrect state-root calculation during state verification.
All BSC-Reth node operators, including validators, MEV builders, full nodes, and sentry nodes, are advised to upgrade to this version and restart the node as soon as possible. This fix does not require a DB migration or hard fork. Users do not need to take any action. BNB Chain has also confirmed that this vulnerability has a limited effect on BSC-Reth and has no effect on opBNB.
