Polygon says several vulnerabilities affecting its Bor and Heimdall clients could have caused denial-of-service attacks, validator resource exhaustion and network disruption, but the flaws were patched before being publicly disclosed.

Polygon has disclosed a series of previously private security vulnerabilities affecting its proof-of-stake network after deploying fixes through two coordinated hard forks.

Related reporting: Solmate outlines infrastructure-focused strategy for digital asset treasury companies

The issues affected Polygon’s Bor and Heimdall clients and included denial-of-service risks, validator resource exhaustion and weaknesses involving checkpoint, milestone and event-processing logic, according to an Aug. 27 disclosure from Polygon’s Validators Support Team.

Polygon said the vulnerabilities were addressed through the Austin hard fork for Bor and the Kyoto hard fork for Heimdall.

Both upgrades were initially distributed privately, tested on Polygon’s Amoy testnet and activated on mainnet before technical details were released publicly.

The project said none of the vulnerabilities were observed causing disruption on mainnet and that the fixes were deployed proactively before any known exploitation.

Austin hard fork closes Bor denial-of-service paths

Bor v2.10.0, deployed through the Austin hard fork, addressed two denial-of-service vulnerabilities affecting block processing.

One issue involved state-sync events used for deposits from Ethereum to Polygon. These events can execute smart-contract code and precompiled functions in a similar way to ordinary transactions, but the gas they consumed was not previously restricted by a hard per-block limit.

According to Polygon, a block containing enough state-sync events — or a particularly expensive event — could have taken long enough to process to temporarily stall the network.

Austin introduced an explicit per-block gas limit for state-sync activity.

The second issue involved Bor’s TxDependency field, which was used as a hint for parallel transaction execution.

Because the field had no size limit, a block producer could potentially include an excessively large payload in an otherwise valid block, causing peers processing the block to crash.

Polygon removed the field from Bor’s wire format entirely.

The Austin hard fork activated on Polygon mainnet at block 91,949,700.

Kyoto addresses validator resource exhaustion

Polygon described a Heimdall vulnerability fixed by the Kyoto hard fork as the most severe issue in the disclosed group.

Heimdall transactions use google.protobuf.Any structures that can be nested inside one another. Without a depth limit, an attacker could construct a transaction containing deeply nested fields that would be relatively inexpensive to create but require validators across the network to perform substantial decoding work.

Polygon said this could have caused correlated resource exhaustion across the validator set.

Heimdall v0.11.0 now rejects transactions that exceed an approved nesting threshold before they can create excessive processing demands.

Kyoto also introduced a cap on fee-coin entries and addressed several additional issues involving checkpoint signatures, milestone voting, validator downtime processing, checkpoint-window validation and L1 event replay protection.

The Kyoto hard fork became active on Polygon mainnet at Heimdall height 51,533,000.

Older nodes must upgrade

Polygon said both upgrades are mandatory.

All Polygon PoS nodes must run Bor v2.10.0 or a later compatible version, while validators and full nodes must use Heimdall v0.11.0 or later.

Nodes that remained on older software after the relevant activation heights have already fallen out of consensus with the canonical network. Operators must upgrade and roll back to a pre-hard-fork height before resynchronizing.

Polygon said neither upgrade requires a state migration, genesis change or full network resync.

The security disclosure comes as POL, Polygon’s native ecosystem token and the successor to MATIC, trades near $0.094. CoinGecko data shows the asset down roughly 13.8% over the past seven days, with a market capitalization of about $1 billion at the time of writing.