Polygon nodes fall out of consensus after two August hardforks

Polygon Labs said nodes on Bor earlier than v2.10.0 or Heimdall before v0.11.0 have fallen out of canonical consensus after two August hardforks.

The company's Aug. 27 security review described the client-compatibility consequence, saying it had not observed mainnet disruption from Austin and framing the disclosed changes as proactive fixes.

Austin activated at mainnet block 91,949,700, capping gas consumed while Bor processes state-sync events from L1-to-L2 bridge deposits. It also removed the TxDependency extra-data field, which a block producer could inflate to crash peers. Kyoto activated at height 51,533,000 on Aug. 18 at 10:10:31 UTC, hardening Heimdall against deeply nested google.protobuf.Any messages and capping fee-coin lists.

Both hardforks are plain binary upgrades with no state migration or genesis change. Operators past the relevant height on an older client must install the applicable release, roll back to a pre-hardfork point if needed, and resync under Polygon's guidance. POL traded at $0.11, down 2 percent over 24 hours.

Austin capped state-sync gas and removed TxDependency

Austin capped the gas consumed while Bor processes state-sync events from L1-to-L2 bridge deposits. Those events execute contract code and precompiles, but their gas use was not previously counted against a fixed block-level ceiling. Enough events, or one sufficiently costly event, could make block processing slow enough to stall the chain transiently.

The second weakness sat in Bor's TxDependency extra-data field, a hint used for parallel execution. Because the producer-supplied field had no size limit, a block producer could place an arbitrarily large blob in an otherwise valid sibling block and crash peers that tried to process it. Austin removed the field from the wire format, and Polygon classified both weaknesses as resource-exhaustion risks.

The public Bor v2.10.0 release records Austin's mainnet and Amoy activation blocks. GitHub showed v2.10.1 as the latest Bor release when checked Aug. 28, while v2.10.0 or later provides Austin compatibility.

Kyoto hardened Heimdall against nested-message abuse

Kyoto's highest-severity fix targets deeply nested google.protobuf.Any messages. A sender could cheaply construct one transaction that forced every validator to spend heavily on decoding. The hardfork added a byte-level nesting check at both mempool admission and block-proposal processing, keeping those paths consistent. It separately capped fee-coin lists before an O(n) validation scan, and Heimdall's integration permits one fee coin.

Other Kyoto changes address distinct edge cases. They normalize checkpoint signature recovery bytes so a valid signature cannot fail recovery on Ethereum and stall anchoring, make repeated producer-downtime messages idempotent, bind milestone-range votes to the signed parent hash, and prevent a failed future-span creation from blocking milestone commitment. Replay keys for topup, clerk, and stake events were also made injective for out-of-range log indexes so distinct layer-1 events cannot silently shadow each other.

Failure to upgrade leaves validators unable to follow the network's accepted history, risking missed checkpoints and anchoring delays on Ethereum. The transition's smoothness will shape POL sentiment as operators race to catch up.

This article is for informational purposes only and does not constitute investment advice.