Lighthouse patched two bugs that could have confirmed the wrong Ethereum chain. Sigma Prime won't say how until you update.
Two fork-choice bugs in Ethereum's consensus layer could have made validators lock in the wrong chain. Sigma Prime is keeping the details hidden until beacon node operators catch up.
CryptoVibe Desk · ethereum · lighthouse · security
- →Lighthouse v8.2.0 patches two fork-choice bugs that could have caused Ethereum validators to justify and finalize the wrong chain of blocks.
- →Sigma Prime is withholding the full vulnerability details until operators upgrade. That blackout says the team treats these bugs as serious.
- →A breaking change stops validator clients from starting without a fee recipient address configured. Check your setup before you upgrade.
- fork-choice → The algorithm Ethereum validators run to decide which chain of blocks is the correct one to build on.
- beacon node → The software that connects a validator to Ethereum's consensus layer and tracks the current agreed state of the chain.
- finality → The point where Ethereum treats a block as locked unless a large share of validators breaks the rules.
- fee recipient → The Ethereum address a validator uses to receive transaction fees from proposed blocks.
Lighthouse v8.2.0 shipped today with two fork-choice bugs patched.
Sigma Prime says both bugs could have caused incorrect block justification and finalization on Ethereum's consensus layer. Fork-choice is the algorithm that picks the canonical chain. If it produces incorrect finality, validators lock in the wrong block. That's not a soft error. Unwinding it requires coordination across the validator set.
Sigma Prime isn't publishing the full vulnerability details yet. The team is giving beacon node operators time to upgrade before the details go public. That's standard responsible disclosure, but still a loud signal. Watch for the advisories once upgrade rates look healthy.
If you run a beacon node, the update priority is high. If you only run a validator client, it's low. And that's the catch: this release can stop your validator client from starting. It now requires `suggested_fee_recipient` globally or per-validator. Check your config before you upgrade, not after.
The release also fixes a slasher out-of-memory bug. The beacon node database migrates automatically from schema v28 to v29 on startup. No manual step is needed, but back up first.
Beyond the security work, the release adds Gloas scaffolding. Gloas is Ethereum's plan to move block-building separation into the consensus spec. Today, that work mostly sits at the relay layer. EIP-8136 partial data column support is also in. It is enabled by default only on Hoodi and Sepolia testnets. Mainnet stays unchanged there for now.
Read the release notes. Don't wait for the thread summary.
Sigma Prime's advisory blackout is the right call. Publishing the mechanism before nodes update would turn a patched bug into a live playbook. Any Ethereum consensus client team without a written disclosure policy is now behind.
Watch for Sigma Prime's full fork-choice advisories within 30 days. If either bug affects another Ethereum consensus client, the indicator is a public patch or advisory from that client team within 7 days of disclosure.
Primary links and supporting reads used by the desk for this story.
Forward this.
