Polygon Labs has disclosed that two recent hard forks on its proof-of-stake network were used to fix several denial-of-service vulnerabilities affecting both Bor and Heimdall, the two main components of the chain. The upgrades were deployed before any exploitation was seen on mainnet, according to the company.
The issues included a Heimdall flaw that could let a single inexpensive transaction trigger heavy decoding work across the full validator set, as well as Bor-side problems tied to state-sync processing and a transaction dependency field that could be abused to crash nodes.
Two forks, two client upgrades
The Austin fork corresponds to Bor v2.10.0 and focused on the execution client. The Kyoto fork corresponds to Heimdall v0.11.0 and addressed vulnerabilities in the consensus-related layer.
Polygon said both upgrades are now required for nodes that want to remain in consensus with the network. Older versions have already diverged from the canonical chain, making the new releases mandatory rather than optional patches.
Heimdall bug centered on nested protobuf transactions
The most serious issue described by Polygon involved transactions wrapped in google.protobuf.Any. Because that format allowed unlimited nesting, an attacker could craft a transaction that was cheap to submit but expensive for validators to process.
That asymmetry created a denial-of-service risk: every validator would be forced to perform substantial decoding work on the same transaction, potentially wasting computing resources across the network. Polygon said Kyoto addresses this by adding a byte-level pre-scan that rejects transactions once nesting goes beyond a defined threshold.
The checks are enforced in two places. Polygon said Heimdall evaluates them when a transaction first enters the mempool and again on the consensus path when validators assemble a block.
Austin addressed two Bor-side DoS paths
On the Bor side, Polygon said the Austin fork patched two separate denial-of-service vectors. One involved state-sync events that could consume unbounded gas within a block, creating a way to burn excessive execution resources.
The other involved the persistent TxDependency field, which the company said could be exploited to crash nodes. As part of the fix, that field was removed from the wire format.
Deployment came before public disclosure
The hard forks were shipped before Polygon publicly explained what they fixed. The company said no exploitation had been observed on mainnet before deployment, and it pushed the changes first to reduce risk while the vulnerabilities remained unpatched.
The immediate next step for operators is clear from the release requirements: nodes need to run Bor v2.10.0 and Heimdall v0.11.0 to stay on the canonical Polygon PoS chain. The broader context is that both forks were consensus changes, not routine software updates, because older nodes no longer track the main network after the fixes took effect.
Source: Cryptopolitan