Polygon has publicly disclosed a set of previously private security vulnerabilities that could have disrupted its proof-of-stake network. The company revealed the flaws only after deploying fixes through the Austin and Kyoto hard forks.

The vulnerabilities affected Polygon's Bor and Heimdall clients and included denial-of-service risks, validator resource exhaustion, and weaknesses in checkpoint and milestone processing. Polygon stated that it found no evidence the flaws were exploited on mainnet. Bor serves as Polygon PoS's block-producing execution client, while Heimdall handles checkpointing and validator coordination, so flaws in either component directly affect how the chain reaches and records consensus.

Fixes Deployed Ahead of Disclosure

Polygon patched the vulnerabilities before publishing their technical details. This approach allowed developers to test the fixes and activate them without giving potential attackers advance warning. It follows the coordinated disclosure model widely used across the software industry and by major blockchain projects, in which technical details are withheld until patches are broadly deployed so that researchers' findings do not become attack blueprints.

The most serious issue affected Heimdall, where a specially crafted transaction could force validators to perform excessive processing work. Such activity could have placed significant pressure on validators and potentially disrupted network operations.

The Austin hard fork resolved two separate denial-of-service risks in Bor. These flaws could have slowed block processing or caused affected nodes to crash.

Polygon said the upgrades were tested before activation on mainnet, and the disclosure came only after the fixes were successfully deployed, reducing the risk that public vulnerability details could be used against unpatched nodes. This is not the first time Polygon has handled critical flaws quietly before revealing them: the project has previously disclosed a patched critical bug in Bor only after the fix was live on mainnet, establishing a pattern of patch-first, disclose-later security practice.

Node Operators Face Mandatory Upgrade

The hard forks also created an immediate requirement for node operators. Nodes running older client versions past the relevant activation heights have fallen out of consensus and must upgrade to reconnect with the canonical Polygon network.

Polygon requires Bor v2.10.0 for Polygon PoS nodes, while validators and full nodes must also run Heimdall v0.11.0. Both versions are already active on mainnet.

The disclosure underscores the importance of coordinated security responses for blockchain networks. Although Polygon avoided a confirmed mainnet exploit in this case, the vulnerabilities could have threatened network availability had attackers discovered and exploited them first.

The Austin and Kyoto upgrades therefore served a dual purpose: as security patches and as critical maintenance steps for Polygon's validator infrastructure. For node operators and infrastructure providers, cases like this are a reminder to track client release notes and activation heights closely, since missing a mandatory hard fork results in immediate disconnection from consensus rather than a degraded-but-functional node.