Polygon fixes validator security flaws with Austin and Kyoto forks

Polygon Labs has patched several security flaws across its proof-of-stake network through two coordinated hard forks, including a vulnerability that could have forced the full validator set to perform costly processing from a single crafted transaction.

Polygon’s Validators Support Team disclosed the fixes in an Aug. 27 forum post after the Austin and Kyoto hard forks had already been tested and activated. The team said consensus-affecting security fixes were deployed privately, validated on the Amoy testnet and disclosed only after the mainnet fleet was protected.

The vulnerabilities affected Bor, Polygon PoS’s execution client, and Heimdall, which handles validator coordination and other consensus functions. Polygon said it found no evidence that any of the issues had been exploited or caused disruption on mainnet.

Polygon hard forks close block processing flaws

The Austin hard fork upgraded Bor to version 2.10.0 and addressed two denial-of-service paths tied to block processing.

One involved state-sync events used for L1-to-L2 bridge deposits. Such events can execute contract code and precompiles, but their execution was not subject to an effective per-block gas bound. Austin introduced a limit on how much gas state-sync events can consume within a block, preventing them from exhausting processing resources.

A separate weakness involved TxDependency data used during block processing. A malicious block producer could supply an oversized data field, potentially causing excessive memory allocation and crashing peers processing the block.

Polygon described both issues as block-processing denial-of-service vectors instead of consensus-correctness flaws and said neither had caused known disruption before the patches were deployed.

The Kyoto hard fork, which moved Heimdall to version 0.11.0, covered a larger group of input-validation and consensus-hardening fixes.

Among them, Polygon identified deeply nested google.protobuf.Any fields as the most severe vulnerability in the batch. Heimdall transactions can wrap messages inside Any fields, which in turn can be nested inside one another.

Without a depth limit, an attacker could construct a transaction containing deeply nested fields at relatively little cost while forcing every validator processing it to carry out substantial decoding work. Polygon said the flaw provided a permissionless route for imposing costly, coordinated processing across the validator set.

Kyoto added a byte-level scan that rejects transactions once nesting exceeds a defined threshold. The check applies at both mempool admission and the consensus processing stage so the same transaction cannot be accepted through one path and rejected through another.

Other Heimdall fixes covered milestone accounting, checkpoint processing and L1 event replay. Failed future-span creation can now degrade and retry at the next boundary instead of blocking a milestone commit, while new replay keys address an edge case in which distinct L1 events could otherwise collide.

Older Polygon nodes have fallen out of consensus

Both hard forks are mandatory for operators that want to remain on the canonical Polygon PoS network.

Bor v2.10.0 is required for all nodes, while Heimdall v0.11.0 applies to validators and full nodes. Polygon said operators running versions from before the activation heights have already forked away from canonical consensus and must update their software to rejoin the network.

The changes were delivered as binary upgrades, meaning operators do not need to migrate state, modify the genesis configuration or perform a full resync. Nodes that have fallen out of consensus can upgrade and roll back to the appropriate pre-hard-fork height before catching up with the canonical chain.

Polygon has previously used hard forks to address problems affecting its PoS infrastructure. In September 2025, developers executed a hard fork after a software bug caused transaction finality delays of as much as 15 minutes.

The earlier incident affected validator synchronization and local fast finality while block production and Ethereum checkpointing continued. Bor and Heimdall updates were deployed to restore milestone processing, state synchronization and consensus finalization.

A month later, the Rio mainnet upgrade introduced witness-based stateless validation and a Validator-Elected Block Producer model as Polygon continued changing how its PoS network processes and verifies transactions.

Polygon has continued changing its PoS infrastructure

Network performance remained another focus in 2026. In May, crypto.news previously reported that Polygon had reduced block time to an average of 1.75 seconds, its first block-time reduction since launch.

Polygon software engineer Lucca Martins said at the time that the change raised theoretical throughput to roughly 3,260 transactions per second and allowed the network to process about 14% more payments per second. The work formed part of Polygon’s push to support higher transaction volumes from stablecoin payments and decentralized finance activity.

The latest security fixes arrived after Polygon completed the replacement of MATIC with POL as the native gas and staking token on its PoS network. The migration began in September 2024 as part of the Polygon 2.0 roadmap, with MATIC held directly on Polygon PoS converted to POL at a one-to-one ratio.

The original MATIC-to-POL plan designated POL as the token used for gas payments and staking, while its proposed functions were expected to expand as Polygon developed its staking and aggregated-chain architecture.

Changes have extended to Polygon Labs itself. In July, the company cut another round of jobs while completing the integration of crypto exchange Coinme. CEO Marc Boiron said the restructuring was designed to support profitability by 2027 as Polygon Labs moved toward a payments-focused business model.

POL showed little positive reaction to the security disclosure. The token was trading near $0.09983 on Aug. 30, down about 2.3% over the previous 24 hours and 6.8% over seven days, according to CoinGecko data provided with the report. Its price remained about 60.8% lower than a year earlier, giving the token a market capitalization of roughly $1.07 billion.