Polygon Discloses Security Vulnerabilities Fixed via Recent Hard Forks

ChainCatcher report: Polygon has disclosed multiple previously unreported security vulnerabilities recently patched via two hard forks, which could have affected its proof-of-stake network. The vulnerabilities involved Polygon’s Bor and Heimdall clients, including risks of denial-of-service, validator resource exhaustion, and flaws impacting checkpoint and milestone processing. Polygon stated that these issues were resolved through the Austin and Kyoto hard forks, with fixes privately tested prior to deployment on mainnet and public disclosure. The most severe issue involved Heimdall, where specially crafted transactions could force validators to perform excessive processing, disrupting the network. The Austin hard fork also fixed two denial-of-service vulnerabilities in Bor that could slow block processing or cause node crashes. Polygon confirmed that none of these vulnerabilities were exploited on mainnet, and the fixes were proactively deployed before details were made public. Nodes running older client versions became disconnected from consensus after the hard fork activation height and must be upgraded to rejoin the canonical network. All Polygon PoS nodes must upgrade to Bor v2.1.0, while validators and full nodes must upgrade to Heimdall v0.11.0—both upgrades are now live on mainnet.