Polygon Fixes Critical Security Flaws With Kyoto and Austin Hard Forks
Polygon Labs quietly released two hard forks that fixed security issues in its proof-of-stake (POS) network. The layer-2 network shared the details in a forum post, requiring all node operators to upgrade or be kicked out of the network consensus.
The worst bug was found in Heimdall, which coordinates Polygon validators. Heimdall bundles transaction contents inside a wrapper called google.protobuf.Any, allowing multiple layers of wrappers without limit. An attacker could create a single transaction with almost no cost, forcing validators to waste computing power unpacking it.
Polygon described the flaw as 'a permissionless way to force costly, correlated work across the whole validator set.' The Kyoto hard fork upgraded Heimdall software to v0.11.0, adding a byte-level pre-scan that rejects transactions with excessive nesting.
The second hard fork, Austin, focused on Bor, Polygon's execution client. It patched two denial-of-service paths and removed the TxDependency field from the wire format entirely, preventing validators from crashing due to huge data loads.