Polygon Reveals Patched Flaws That Could Have Crashed PoS Nodes

Polygon Discloses Austin and Kyoto Security Fixes

In its technical release review, Polygon said Austin closed two denial-of-service paths in Bor, the execution client for Polygon PoS.

One fix puts a hard per-block limit on the gas consumed by state-sync events—operations used for L1-to-L2 bridge deposits. Before the change, enough expensive events in one block could have consumed sufficient processing time to transiently stall the chain, Polygon said.

Austin also removed Bor’s TxDependency wire field. A malicious block producer could have inserted an arbitrarily large blob in that field, causing peers that processed an otherwise valid sibling block to crash. Polygon says parallel execution does not depend on trusting that producer-provided hint, so the field could be removed without changing downstream behavior.

Kyoto’s broader set of changes focuses on Heimdall, Polygon PoS’s consensus and validator layer. Its key protection caps the nesting depth of google.protobuf.Any messages. Without that limit, Polygon said an attacker could make a cheap transaction that forces every validator to perform substantial decode work. The updated software rejects overly nested input consistently in the mempool and consensus paths.

The package also caps fee-coin lists and hardens checkpoint signatures, milestone-range votes and replay protection for several L1 event types. These are liveness and validation protections, not a change to POL supply or an upgrade to an application contract.

No Exploit or Onchain Loss Was Reported

Polygon’s own assessment is unusually specific on the point that matters most to holders and users: neither Austin’s block-processing vectors nor Kyoto’s validator-resource issue was observed causing a mainnet disruption before the patches were activated.

The company did not publish attacker addresses, theft totals, victim counts, affected-wallet counts or a recovery plan because it did not identify a live exploit. That separates the news from the recent Cosmos EVM incident, where a post-mortem described an estimated $5.72 million drained across six networks.

It also differs from a chain outage after an active exploit, such as MANTRA’s halt after an EVM-module attack. Polygon’s report describes vulnerabilities that were fixed before a reported attack, not a retrospective explanation of missing funds.

That distinction does not make the disclosure trivial. A denial-of-service path can interrupt transaction confirmation, bridge operations and application availability even without enabling an attacker to take custody of tokens. But it does mean readers should not treat the bug descriptions, which were published after activation, as proof that funds were compromised.

Polygon Nodes Must Upgrade to Rejoin Canonical Chain

For infrastructure operators, the response is not optional. Polygon says Bor v2.10.0 is mandatory for all Polygon PoS nodes, while Heimdall v0.11.0 is mandatory for validators and full nodes. Both are already active on mainnet.

The release review says an operator that continues past the activation heights on earlier software has already forked away from the canonical chain and needs to upgrade and catch up. The stated upgrade path is a binary update; Polygon says no state migration or full resynchronization is required for normally updated operators.

That operational message is the reason the story has a wider audience than a conventional technical changelog. A public RPC provider, exchange, bridge operator or validator on stale software may show an outdated chain view or fail to participate correctly until it moves to the required versions.

Polygon later posted Bor v2.10.1 for Amoy and mainnet, reinforcing that operators should follow the project’s current release channel rather than stop at the original disclosure. Users do not ordinarily need to run those clients themselves, but they should expect providers to complete the maintenance promptly.

The Fear and Greed Index was 62, or Greed, on Aug. 31.

Polygon’s disclosure offers a straightforward takeaway: the chain says it fixed a potentially disruptive set of client flaws before they were exploited, but the protection only applies to operators that have moved onto the active Bor and Heimdall releases.