Polygon Fixes Critical Security Issues with Quiet Hard Forks

Polygon Labs recently released two hard forks to fix critical security issues in its proof-of-stake (POS) network. The layer-2 network waited until after the fixes were implemented before revealing the details, which involved upgrading node operators' software to prevent being kicked out of the consensus.

The Heimdall software, which coordinates Polygon validators, was affected by a bug that allowed an attacker to create complex transactions with minimal cost. This forced validators to waste computing power to unpack the transaction, described as 'a permissionless way to force costly, correlated work across the whole validator set.'

The Kyoto hard fork upgraded Heimdall software to v0.11.0 and added a byte-level pre-scan that rejects transactions with excessive nesting. Polygon checks for this issue twice: when a transaction arrives and when validators build the block.

The second hard fork, Austin, focused on Bor, Polygon's execution client. It patched two denial-of-service paths by capping state-sync gas per block and removing the TxDependency field from the wire format entirely.