Flashbots patches BuilderNet Priority Update Registry V1 storage alias
By 8bitcrypto
September 17, 2026
On September 15, Flashbots identified a critical storage-aliasing bug in Priority Update Registry V1—the on-chain contract BuilderNet trading integrators use to publish and read priority price updates—and disclosed the fix the next day. The flaw let any address authorize itself as an updater for any registered target, publish arbitrary prices, or corrupt legitimate updater authorizations. For Dev Pulse readers, this is infrastructure security around propAMM settlement feeds, not a marketplace mint calendar.
Per Flashbots’ September 16 security advisory, the vulnerable Ethereum mainnet registry at 0xDa7AfeeD01fe625CF15d187a19f94B45f00b8C5F is superseded by the fixed deployment 0xDa7AfEeD021EAFC1c1Af9C362dE477DaD0396B81. A BNB Smart Chain BAP-710 variant was also remediating with maintainers. Flashbots says affected integrator funds are secured and canonical references now point to the fixed contract. The team found no evidence the vulnerability was exploited before remediation—framed explicitly as “no evidence found,” not a proof of absence.
Mechanically, V1 computed a lane storage slot as keccak256(abi.encode(laneTarget, laneIndex)) with a caller-chosen unbounded laneIndex, while the authorization map lived at storage slot 0. By setting lane parameters to collide with isUpdater[target][attacker], a caller could write into the authorization table without a cryptographic search—just a deterministic layout collision. That is the Dev Pulse core: storage layout as an access-control surface.
Impact depended on how each target consumed the feed. Contracts treating registry prices as trusted settlement input without independent staleness, deviation, or per-pair checks could have settled at attacker-controlled prices. Targets with their own constraints or authorization gates were less exposed. Flashbots assessed known integrations across affected chains and reports funds secured; smaller V1-style instances sharing the layout should still migrate even if no value was identified at risk.
The fix namespaces lane storage with keccak256("PrioUpdateRegistry.lane") so the 96-byte lane preimage cannot equal the 64-byte authorization preimage (commit 8701e8e). Integrators cannot treat migration as a drop-in address swap: they must re-establish updater authorizations, re-initialize lane state, update verifying-contract signing domains, and replace immutable consumers that hardcoded the old registry. Flashbots also urges minimizing token allowances and keeping emergency fund-move paths ready.
Timeline color: the bug was found September 15 during a registry integration review and remediated the same day; the public advisory landed September 16. SEAL 911 had notified one propAMM team on September 7, but Flashbots says it was not initially told because the issue was thought limited to that system—useful coordination note for NFT/DeFi teams that share BuilderNet priority-update rails.
For NFT collectors, the practical Dev Pulse read is bid-currency plumbing risk. PropAMMs and priority-update consumers sit upstream of how ETH and stable liquidity get priced into marketplace settlement paths. A poisoned price lane would not mint a fake Bored Ape, but it could mis-settle the DeFi legs that fund bids. Treat this as a call to confirm any wallet, vault, or market-making stack you touch has migrated off V1—not as proof that OpenSea or Magic Eden floors moved on the advisory day.
What Thursday’s file proves is narrow. Flashbots disclosed and patched a critical Priority Update Registry V1 storage alias on Ethereum (and coordinated BNB remediation), with no observed exploit in their review window. What it does not prove is that every fork or copy is already safe. Operators should verify their own storage history, because aliasing writes emit no event.
For 8bitcrypto readers on September 17, the clean Dev Pulse line is BuilderNet’s price-update registry layout bug—authorize-anyone via storage collision—now namespaced and migrated, with NFT desks watching settlement-feed integrity rather than a new collection drop.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).