Polygon Quietly Patches Security Flaws in Two Private Hard Forks

Polygon Labs quietly patched a batch of security flaws in its Proof-of-Stake (PoS) network through two private hard forks, Austin on Bor and Kyoto on Heimdall. The patches closed denial-of-service (DoS), resource-exhaustion, and consensus-hardening risks across the Polygon PoS client stack.

Austin addressed two block-processing DoS paths in Bor v2.10.0: state-sync events were not metered against a hard per-block gas cap, allowing a block to slow down processing, and an arbitrary large blob could be stuffed into a sibling block, crashing peers that tried to process it.

Kyoto targeted deeply nested google.protobuf.Any fields in Heimdall transactions, which could force validators to perform expensive decode work simultaneously. Kyoto also bundled smaller hardening fixes for transaction-processing edge cases, similar to protocol-level changes aimed at emerging threats elsewhere in the industry.