Polygon Unveils Critical Hard Forks to Plug Security Holes

Polygon Labs has released two critical hard forks to address significant security vulnerabilities found in its network. The company disclosed details about these upgrades, which include the Austin and Kyoto forks, in a newly published forum post, calling on all node operators to update their software or risk being removed from the network consensus.

The most severe flaw was discovered in Heimdall, the coordination software used by Polygon validators. This vulnerability stemmed from how Heimdall handled transaction data, placing each transaction inside a wrapper called google.protobuf.Any. The Kyoto hard fork upgraded Heimdall to version 0.11.0 and implemented a byte-level pre-scan mechanism that rejects any transaction exceeding a set nesting threshold.

The Austin hard fork addressed two denial-of-service vulnerabilities in Bor, Polygon's transaction execution client. To prevent these risks, the Austin upgrade introduced a strict per-block gas limit on state-sync events and eliminated the TxDependency field from the communication format entirely.