Optimism patched kona-client for a critical state trie bug. If you're running v1.2.13, update now.
A wrong state trie in a proof client produces wrong proofs. Multi-client security is a real upgrade, but it comes with a multi-client maintenance bill.
CryptoVibe Desk · optimism · kona-client · fault-proofs
- →Optimism released kona-client/v1.2.14 today, a critical fix for a state trie bug that dropped destroyed-and-recreated accounts in v1.2.13.
- →State trie errors in a proof client produce wrong state roots, which breaks the correctness guarantee multi-client proofs are built on.
- →Watch for a post-mortem from Optimism naming which OP Stack chains ran v1.2.13 in production, before end of May 2026.
- state trie → A data structure that records every account's balance, nonce, and code on the chain; a wrong entry produces a wrong state root, which is the fingerprint used to verify the chain's state.
- fault proof client → Software that re-executes L2 transactions off-chain to verify that the state root posted on Ethereum is correct; if it computes a wrong state root, it can accept or reject blocks incorrectly.
- back-port → Taking a fix written for a newer version of software and applying it to an older version that is still in active use.
Optimism's kona-client got a critical security fix today. The release, v1.2.14, patches a state trie bug that affected v1.2.13, per the release notes.
The bug: kona-client wasn't reinserting `DestroyedChanged` accounts back into the state trie. A `DestroyedChanged` account is one deleted and then recreated in the same block. Miss that reinsertion, and the state root you compute is wrong. A wrong state root in a proof client means wrong proofs.
kona-client is Optimism's Rust-based fault proof client, separate from op-geth. That separation is exactly the point of multi-client: if one client computes a wrong state, others can catch it. The tradeoff is that each client carries its own bugs. This one lived in the Rust path, and the fix back-ports PR #20640.
Two other Optimism releases landed this week. op-node/v1.18.0 removes the `--rollup.halt` and `--rollup.load-protocol-versions` flags, flag deprecations, not security. kona-node/v1.5.0 fixes a separate EIP-2935 storage slot decoding bug. Neither carries the critical label.
If you run an OP Stack node, your update surface just got wider. Multi-client is the right security model. And that's the catch: the same diversity that raises the security ceiling means more software to keep current.
Optimism released the patch without naming which chains were running v1.2.13. That's the wrong way to handle a critical security update: operators should know their own exposure.
A formal Optimism disclosure naming which OP Stack chains ran v1.2.13 in production and for how long, before end of May 2026.
Primary links and supporting reads used by the desk for this story.
Forward this.
