Polygon Fixes Critical Bugs in Proof-of-Stake Network with Two Hard Forks

Polygon Labs has quietly released two hard forks that fixed several security issues in its proof-of-stake (POS) network.

The layer-2 network shared the details in a forum post, stating that all node operators must upgrade or be kicked out of the network consensus.

The worst bug was in Heimdall, which bundles transaction contents inside a 'google.protobuf.Any' wrapper. This allowed an attacker to create a single transaction with multiple layers for almost no cost, forcing validators to waste computing power to unpack it.

Polygon described the flaw as 'a permissionless way to force costly, correlated work across the whole validator set.'

The Kyoto hard fork upgraded Heimdall software to v0.11.0 and added a byte-level pre-scan that rejects transactions with excessive nesting.

The Austin fork focused on Bor, Polygon's execution client, and patched two denial-of-service paths by capping state-sync gas and removing the TxDependency field from the wire format entirely.