An October 13, 2026 ChainSecurity report found EIP-8037 and EIP-8038 break smart contracts when external calls fail, tied to eight smart contract invariants

Overview Debates Related claims Topics Sources

The Ethereum Foundation called for smart contract checks after security audits raised concerns regarding Glamsterdam upgrade proposals

Ethereum core developers delayed the implementation of the Glamsterdam upgrade on the Hoodi testnet until security concerns involving eight smart contract invariants are resolved

The Ethereum Foundation stated on November 6, 2026 that EIP-8037 and EIP-8038 change how gas is charged for certain operations

Cc9f267dcClaimNews event

The Tempo development team discovered the Reth state-root software bug through automated security testing known as fuzzing

Cc9f267dcClaimNews event

Coinbase-backed layer-2 network Base patched its block builders without impacting users

Cc9f267dcNews eventClaim

Developers merged pull request #28264 containing the upstream software fix into Reth's GitHub code repository

Security firm Blockaid confirmed the Reth state-root calculation flaw was a code calculation error rather than an active exploit, with no stolen funds reported

Reth's block-building software used vulnerable calculation code across networks built with Optimism's OP Stack, creating shared defect risks across multiple interconnected Ethereum layer-2 blockchains

Cross-chain messaging protocol LayerZero temporarily paused select transfer routes as a precautionary measure while developers evaluated operational risks related to the Reth state-root software defect

Frax Finance reported on November 5, 2026, that its smart contracts and user assets remained secure despite LayerZero's temporary cross-chain route suspensions

Georgios Konstantopoulos, chief technology officer at Paradigm, said a flaw in execution client Reth's legacy state-root calculation system could return incorrect cryptographic hashes when processing specific smart contract storage configurations

Security firm Blockaid warned that blockchain nodes still running unpatched Reth software code could freeze up or return faulty state proofs

b14g paused its affected staking contracts at 10:35 UTC on October 31, 2026, approximately 66 minutes after the initial exploit occurred.

An attacker drained 91 staking positions in a single transaction on October 31, 2026, by submitting 99 zero-value withdrawal requests against unbacked staking positions on b14g.

The contract logic exploited in the October 31, 2026 b14g breach had been active for approximately 17 months prior to the incident without requiring administrator key compromises.

Core's underlying staking contract contains logic that interprets a withdrawal request for zero tokens as an instruction to release the entire staked balance of a position.

Base said Denim blocks B20 token mints, transfers, and seizures targeted at a token contract's own address to prevent permanent asset locking

The Security Council temporarily modified Arbitrum's Inbox contract using a function called sendUnsignedTransactionOverride to process transactions as if sent by the Binance exploiter's address, before restoring the original contract code

Arbitrum's Security Council initiated the transfer of Binance exploit funds by calling the UpgradeExecutor contract through its Safe wallet in Ethereum block 26301886

Security firm Zealynx noted that blockchain rules requiring a private key to authorize transfers hold true only up to whoever controls the protocol's upgrade path