Polygon ships 2 hard forks to fix validator DoS vulnerability

Polygon Labs shipped two hard forks — Austin on Bor, Kyoto on Heimdall — to patch denial-of-service and consensus flaws before disclosure.

The fixes were rolled out privately and validated on the Amoy testnet before mainnet activation, according to a Polygon forum post published Aug. 27. No mainnet disruption was observed from the vulnerabilities Austin addressed, and both forks were already active on Amoy and mainnet by the time the disclosure went public.

Austin closed two Bor block-processing denial-of-service paths. State-sync events, which handle L1-to-L2 bridge deposits, previously had no hard per-block gas cap, allowing a block carrying enough events to transiently stall the chain. The fork also removed Bor's TxDependency wire field entirely — a parallel-execution hint with no size limit that a malicious block producer could stuff with an arbitrarily large blob to crash peer nodes.

Kyoto's most severe fix targeted deeply nested google.protobuf.Any fields in Heimdall transactions. Without a cap, a single cheaply crafted transaction could force every validator to perform disproportionately expensive decode work simultaneously. Kyoto added a byte-level pre-scan enforced identically at mempool admission and on the consensus path, so a transaction can't slip through one check and get rejected by the other.

Austin activated at Amoy block 44,120,000 and mainnet block 91,949,700. Kyoto activated at Amoy height 42,252,000 and mainnet height 51,533,000. Both upgrades are mandatory for all node operators and validators, requiring no state migration or genesis change. POL was trading around $0.09983 Sunday, down 2.3 percent on the day and 6.8 percent on the week, according to CoinGecko.

What Austin and Kyoto Actually Fixed

Bor handles block execution while Heimdall runs consensus, and Kyoto's fixes span ABCI, milestone, bor, stake, topup, clerk and bridge processing — touching checkpoint finality, milestone accounting and L1-event replay logic all at once. Kyoto also bundled smaller hardening fixes: a cap on fee-coin counts, normalized checkpoint signature recovery bytes, idempotent handling of repeated producer-downtime messages, milestone range votes bound to the signed parent hash, checkpoint-window continuity checks, non-halting future-span creation, and injective replay keys for topup, clerk and stake L1 events.

Bor v2.10.0 is mandatory for all nodes; Heimdall v0.11.0 is mandatory for all validators and full nodes. Both are plain binary upgrades with no state migration or genesis change required for operators already current. Nodes still running pre-fork binaries past the activation heights have already forked off canonical consensus and need to upgrade and roll back to resync.

POL has slid roughly 60.8 percent over the past year, leaving it with a market capitalization near $1.07 billion. The vulnerabilities were resource-exhaustion and consensus-edge-case risks, not correctness failures, and both were resolved before any exploitation was observed on mainnet. The coordinated client upgrades carry operational stakes for any high-throughput chain, and Polygon's approach — fix first, disclose after — mirrors standard practice for consensus-affecting vulnerabilities across the industry.

This article is for informational purposes only and does not constitute investment advice.