1 hour ago
22
Polygon Labs has disclosed a pair of security vulnerabilities that were quietly patched across two hard forks before the network said anything publicly. The fixes landed in the Austin and Kyoto upgrades, which activated on the Polygon proof-of-stake mainnet on August 29, with a community forum post describing the technical details following two days earlier.
What was actually broken
The Austin hard fork upgraded the Bor execution client to v2.10.0, activating at mainnet block 91,949,700. Kyoto upgraded the Heimdall consensus client to v0.11.0, activating at block height 51,533,000.
On the Bor side, two categories of problems needed addressing. First, L1-to-L2 state-sync events were effectively un-metered, meaning they could consume block resources without the gas accounting that normally limits runaway computation. The Austin fork introduced per-block gas bounds to cap that exposure.
The second Bor issue involved unbounded TxDependency data, a structure Bor uses internally to track transaction ordering. Without limits on how large that structure could grow, a crafted input could stall block processing or crash connected peers entirely.
Heimdall’s problems were different in character. The consensus client had byte-level nesting vulnerabilities in how it handled protobuf Any messages, a serialization format used heavily in the Cosmos SDK stack that Heimdall is built on. Nested message handling errors and signature validation issues in that layer could be used to disrupt consensus messaging between validators. The Kyoto fork patched those checks at the byte level.
Both forks required only binary upgrades. No genesis file changes, no state migration, no rewriting of historical chain data. Validators needed to update their software; the chain state itself remained intact.
What happens to nodes that didn’t upgrade
Any validator or node operator still running pre-fork binaries is now operating outside canonical consensus. Those nodes have effectively forked themselves onto a chain that the rest of the network has abandoned.
Polygon’s guidance is direct: upgrade to Bor v2.10.0 or higher and Heimdall v0.11.0 or higher immediately, or follow rollback and resynchronization procedures.
Polygon reported no mainnet disruption during either activation. Both forks were validated on the Amoy testnet before the mainnet deployment, and the community forum disclosure was timed to follow the successful mainnet activation rather than precede it.
Pattern of proactive upgrades in 2026
Austin and Kyoto are not isolated events. Polygon activated the Ithaca hard fork in July 2026, which targeted liveness improvements and payment reliability on the network.
The Polygon PoS network has been navigating a significant architectural transition over the past year. The shift from MATIC to POL as the network’s native token, combined with ongoing discussions about staking reform and the introduction of a liquid staking token called sPOL, means the validator and staker community is absorbing both economic and technical changes simultaneously.
Validator operators who have not yet upgraded should treat this disclosure as urgent. The combination of the DoS vulnerability description now being public and the fact that pre-fork nodes are already off canonical consensus makes running old binaries a compounding problem rather than a temporary one.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
English (US) ·