Polygon Patches Security Flaws via Two Hard Forks

Key facts

• Polygon Labs fixed security vulnerabilities through two private hard forks: Austin (Bor client) and Kyoto (Heimdall client).
• The Austin fork closed denial-of-service paths in block processing.
• The Kyoto fork addressed a severe flaw allowing a single transaction to force costly validator work.
• Fixes were validated on testnet before mainnet activation and disclosed publicly afterward.
• No vulnerabilities were exploited on the mainnet.
• The upgrades are mandatory for node operators.

Polygon Labs has revealed that it fixed a batch of security vulnerabilities in its proof-of-stake network through two hard forks that were rolled out privately before being disclosed publicly. In a forum post published Wednesday, the team detailed the fixes bundled into the Austin hard fork on its Bor client and the Kyoto hard fork on its Heimdall client. Both were deployed following what Polygon described as standard practice for consensus-affecting fixes: rolling them out quietly and validating them on the Amoy testnet before mainnet activation, then going public once the network was safe. The Austin fork closed two denial-of-service paths in block processing, including one where a malicious block producer could crash peer nodes by stuffing a block with an oversized data field. The Kyoto fork addressed a larger set of consensus-hardening issues, the most severe being a flaw that would have let an attacker force costly, coordinated work across the entire validator set using a single crafted transaction, cheap to build but expensive for the network to process. Polygon stressed that none of the flaws were observed being exploited on mainnet and that all were resolved proactively. Both upgrades are now mandatory for node operators and are already active, requiring no state migration or resync. The disclosures land during a pivotal stretch for Polygon, which completed the migration of its legacy MATIC token to POL, as part of a broader overhaul of its network architecture. The news did little to lift the price of POL, which was trading around $0.09983 on Sunday, down 2.3% over 24 hours, according to CoinGecko. The token has slid roughly 6.8% over the past week and is down about 60.8% over the past year, leaving it with a market capitalization near $1.07 billion despite gains over the past month.