Polygon says Austin and Kyoto hard forks fixed security issues in PoS network
Key Takeaways
- •Kyoto upgrades Heimdall to v0.11.0 and rejects transactions that exceed a nesting threshold before they reach consensus.
- •Austin patches Bor by imposing a hard per-block limit on state-sync gas and eliminating the TxDependency field from the wire format.
- •Polygon said none of the vulnerabilities were exploited on mainnet and that the fixes were completed before the forks were activated.
- •All nodes must run Bor v2.10.0, while validators and full nodes must use Heimdall 0.11.0, or they will diverge from the canonical chain.
- •Polygon said the upgrades require only binary updates and do not involve state migration, a genesis change, or a full resync.
Polygon Labs quietly released two hard forks that fixed a number of security issues in its proof-of-stake (PoS) network.
The layer-2 network later shared the details in a forum post. All node operators must upgrade or they will be kicked out of network consensus.
Austin fork stops nodes from sending the TxDependency field
The most serious bug was in Heimdall, the software that coordinates Polygon validators.
According to a forum post by Parvez03, Heimdall bundles the contents of each transaction inside a wrapper called google.protobuf.Any.
A wrapper can sit inside another, much like boxes packed inside other boxes. In this case, however, there was no cap on how many layers deep the wrappers could go.
An attacker could create a single transaction stacked with those layers for almost no cost, forcing validators to waste computing power unpacking it.
Polygon described the flaw as “a permissionless way to force costly, correlated work across the whole validator set.” The fix matters because validator coordination software sits on the network’s critical path: if it can be made to do unnecessary work, that can affect consensus reliability even when no funds are directly at risk.
The Kyoto hard fork upgraded Heimdall to v0.11.0.
“Kyoto adds a byte-level pre-scan that rejects a transaction once its nesting passes a threshold, enforced identically at mempool admission ( CheckTx ) and on the consensus path ( ProcessProposal ),” the post said.
Polygon checks twice: when a transaction arrives, and when validators build the block.
The second hard fork, Austin, focused on Bor, Polygon’s execution client. It patched two denial-of-service paths.
One involved state-sync events, the process that carries L1-to-L2 bridge deposits. Those events execute contract code and precompiles, just like a normal transaction would. However, the amount of gas burned was not capped per block.
The Austin fork adds a hard per-block limit on state-sync gas.
Polygon also never capped the size of the TxDependency field. A validator could load it with huge data and crash every node that read the block, even though nothing else about the block appeared incorrect.
Austin removes the field from the wire format entirely.
Kyoto fork activated at Heimdall height 51,533,000
Polygon said nobody exploited the bugs on mainnet and that it fixed them all before the forks went live.
The Austin fork was activated on mainnet at Bor block 91,949,700, and the Kyoto fork at Heimdall height 51,533,000.
Every node requires Bor v2.10.0. Validators and full nodes also require Heimdall version 0.11.0. Nodes running older software have already forked from the canonical chain.
The fixes are simple binary upgrades, with no state migration, genesis change, or full resyncs needed, which should make adoption less operationally heavy for node operators.
POL traded at $0.09, down about 9.3% over the past 24 hours. The token is in the green zone, up 25.8% over the last 30 days, according to CoinGecko.
In July, the Heimdall V2 mainnet went offline for about an hour, according to a previous Cryptopolitan report.
