Crypto: Polygon reveals the vulnerabilities fixed by Austin and Kyoto

Polygon has finally explained what its Austin and Kyoto hard forks were hiding. The two updates fixed several security vulnerabilities kept private during their deployment. Some could slow down the network, crash nodes, or force validators to perform very costly computational work. Polygon claims no exploitation was observed on the mainnet.

In Brief

Crypto: Austin closed two vulnerabilities in Bor

Polygon is already familiar with security hard forks. In 2025, the network had to fix a critical bug with an emergency update. This time, Austin focused on Bor, the client responsible in particular for producing Polygon PoS blocks.

The first vulnerability concerned state sync operations from Ethereum to Polygon. These operations can execute code and consume gas. Unlike traditional crypto transactions, no strict limit capped their total consumption in a block.

A sufficiently loaded block could therefore demand too much work from nodes. Polygon added a limit. The second weakness came from a field called TxDependency. It was used to aid the parallel execution of transactions, but its size was unbounded.