Polygon Labs disclosed multiple security vulnerabilities across its proof-of-stake network on Thursday, revealing flaws that had already been patched through two coordinated hard forks before the public knew they existed. The fixes shipped through the Austin hard fork on Bor v2.10.0 and the Kyoto hard fork on Heimdall v0.11.0. Both were deployed privately, validated on the Amoy testnet, and activated on mainnet before Polygon's Validators Support Team published details. None of the vulnerabilities were observed being exploited before the patches went live.
Nodes still running older versions of either client past the activation heights have already fallen out of consensus with the canonical chain. Bor v2.10.0 is mandatory for all Polygon PoS nodes. Heimdall v0.11.0 is required for validators and full nodes. Both upgrades require no state migration, no genesis change, and no resync from scratch. Nodes that missed the activation height must upgrade and roll back to pre-fork heights to resync and rejoin the network.
The most severe flaw sat inside Heimdall's transaction handling
The Kyoto hard fork addressed the most consequential issue in either batch. Heimdall transactions wrap inner messages in protobuf Any types, and Any can nest inside Any without limit. A single crafted transaction with sufficiently deep nesting could force every validator on the network to perform a large amount of decode work simultaneously. The cost to an attacker was minimal. The cost to the validator set was correlated and potentially severe.
Kyoto's fix adds a byte-level pre-scan that rejects a transaction once its nesting passes a defined threshold. The same check runs at mempool admission and on the consensus path, which matters because a gap between those two enforcement points would allow a transaction to enter the mempool and reach consensus processing even if one path rejected it. The threshold sits above anything a legitimate transaction would produce, so normal traffic is unaffected.
Polygon's practice of private patching followed by public disclosure reflects a broader standard in blockchain security
The Austin hard fork on Bor closed two separate denial-of-service paths in block processing. The first involved state-sync events, which are L1 to L2 bridge deposits that execute contract code and precompiles. Those events consumed gas during execution but had no hard cap on how much gas a single block could spend on them. A block carrying enough state-sync events, or one sufficiently expensive event, could slow block processing enough to transiently stall the chain. Austin added a per-block bound matching the treatment normal transaction gas already received.
The second Bor fix removed a wire-format field called TxDependency entirely. The field existed as a hint for parallel transaction execution, telling peers which transactions in a block did not conflict with each other. It carried no size limit, which meant a block producer could include an arbitrarily large TxDependency blob in an otherwise valid block. Any peer that received such a block would crash during processing. Parallel execution does not depend on trusting a producer's hint to function, so removing the field had no downstream effect on performance.
How the Kyoto hard fork addressed checkpoint and milestone accounting
Beyond the nested-Any fix, Kyoto bundled several additional hardening changes across checkpoint finality and milestone handling. A checkpoint signature's recovery byte was not canonicalized before submission to L1, which meant a validly-signed checkpoint could reach L1 in a form that failed signature recovery. That would stall checkpoint anchoring without any forgery. The fix normalizes the recovery byte before submission.
A separate issue allowed a validator's vote to count toward a milestone range extension without the validator having attested to the specific parent block it extended from. Kyoto bounds milestone range votes to the signed parent hash. Another fix made producer-downtime message handling idempotent, so processing the same message twice creates no second span.
Polygon's Heimdall is a fork of Tendermint, which became the consensus engine underlying the Cosmos SDK. The nested-Any vulnerability class is specific to how Heimdall extended that codebase rather than a flaw in the upstream Tendermint implementation itself. Cosmos-based chains that did not adopt Heimdall's Any-wrapping pattern for transaction messages would not share the same exposure. The fix Polygon deployed is therefore a Heimdall-specific patch rather than something Cosmos SDK chains need to audit against directly.
POL, Polygon's native token formerly known as MATIC, traded around $0.08961 at the time of writing, down roughly 14% in 24 hours, according to CoinMarketCap data.
What node operators must do and when
Both hard forks are already active. Amoy activation for Austin came at block 44,120,000, with mainnet activation at block 91,949,700. Kyoto activated on Amoy at height 42,252,000 and on mainnet at height 51,533,000. Operators whose nodes have not yet upgraded past those heights are already off the canonical chain. The upgrade path for both clients is a binary replacement with no additional migration steps.
Polygon has disclosed previous hard forks under similar conditions. The Delhi hard fork in 2023 addressed a critical vulnerability in Heimdall's fee handling that could have allowed double-spending under specific conditions, disclosed after the fix was active. The pattern of private patching followed by post-activation disclosure has been consistent across Polygon's security response history, though Thursday's release was notably more detailed than some earlier disclosures in describing the specific attack surfaces each fix closed.
Matvii Diadkov
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
