Polygon Patches DoS Vulnerabilities in Austin Hard Fork for Bor
- Polygon Labs has disclosed a series of previously private security vulnerabilities affecting its proof-of-stake network.
- According to a disclosure from the Polygon Labs Validators Support Team, none of the vulnerabilities were observed being actively exploited on the mainnet prior to remediation.
- The most severe security issue identified by Polygon involved Heimdall, the validator-facing component that handles consensus operations, checkpoints, and milestones.
Polygon Labs has disclosed a series of previously private security vulnerabilities affecting its proof-of-stake network. The critical flaws—spanning denial-of-service risks, validator resource exhaustion, and defects impacting checkpoint and milestone processing across the network’s core clients—were successfully patched through the Austin and Kyoto hard forks.
Austin and Kyoto Hard Forks Neutralize Core Flaws
According to a disclosure from the Polygon Labs Validators Support Team, none of the vulnerabilities were observed being actively exploited on the mainnet prior to remediation. The fixes were deployed privately and thoroughly tested before being activated on the mainnet and subsequently disclosed to the public.
Targeting Heimdall and Bor Clients
The most severe security issue identified by Polygon involved Heimdall, the validator-facing component that handles consensus operations, checkpoints, and milestones. According to Polygon Labs, a specially crafted transaction could have forced validators to execute excessive processing work. This classic resource exhaustion pattern risks causing performance degradation or availability drops rather than direct asset loss.
Separately, the Austin hard fork addressed two distinct denial-of-service vectors within Bor, the execution layer client responsible for block production and processing. Polygon reported that these Bor issues could have slowed down block processing or triggered node crashes. Left unpatched, such failures typically manifest for traders as network congestion, delayed finality, and unreliable transaction execution during periods of high market volatility.
Strict Consensus Upgrade Mandates for Operators
Despite the proactive patching, the upgrade introduces strict operational requirements for network participants. According to Polygon’s disclosure, nodes running older versions of either client past the hard fork activation heights have already lost consensus and must upgrade immediately to rejoin the canonical network.
To maintain network stability, Polygon mandates that all Polygon PoS nodes upgrade to Bor v2.10.0. Additionally, validators and full nodes must run Heimdall v0.11.0. Both upgrades are already active on the mainnet, leaving network operators responsible for ensuring their infrastructure is fully updated to avoid falling out of sync with the canonical chain.