Polygon Fixes Key Validator Security Bugs with Austin and Kyoto Hard Forks

Polygon has recently patched a batch of security vulnerabilities in its proof-of-stake network. The issues were fixed through two coordinated hard forks, Austin and Kyoto, which were conducted before being publicly disclosed.

The team behind Polygon said none of the flaws had been exploited on the live network prior to the patches going out. However, some of the bugs carried the potential to disrupt how the network processes transactions.

The vulnerabilities affected two important pieces of software: Bor, which handles execution, and Heimdall, which manages validator coordination and other consensus-related tasks. The team found no signs that any of the bugs had been exploited or caused problems on the live network before the patches went out.

The Austin hard fork updated Bor to version 2.10.0 and fixed two issues: state-sync events, which can run contract code without a limit on processing power within a single block; and a data field used during block processing that could be submitted in an oversized version by a malicious block producer.

The Kyoto hard fork updated Heimdall to version 0.11.0 and addressed issues linked to input validation and network hardening, including a bug that would have forced validators processing transactions built using nested data fields to do costly decoding work.