The Sepolia Incident

This blog post discloses an Ethereum network threat, present from the Merge until the Dencun hard fork, in which an attacker could make most nodes (Geth) reject blocks that a minority accepted. The threat stemmed from RPC message size limits carried over to the engine API, which let some clients consider a block valid while others rejected it with HTTP error 413. On February 7, the team found a block could hit the 5MB limit using transactions under 128KB and within 30 million gas, so all clients raised their RPC limits instead. Geth was released with the fix on February 9, and Nethermind, Besu, Erigon and Reth also updated their defaults to safe versions.