Polygon Quietly Patched Security Flaws in Two Hard Forks Before Disclosing Them

In brief

• Polygon Labs disclosed it patched a batch of security vulnerabilities through two hard forks—Austin on its Bor client and Kyoto on Heimdall—rolled out privately and validated on testnet before mainnet activation.
• The fixes closed denial-of-service paths in block processing and a more severe flaw that could have forced costly, coordinated work across the entire validator set via a single crafted transaction.
• Polygon’s native token POL was trading around $0.09983 Sunday, down 2.3% on the day and 6.8% on the week.

Polygon Labs has revealed that it fixed a batch of security vulnerabilities in its proof-of-stake network through two hard forks that were rolled out privately before being disclosed publicly.

In a forum post published Wednesday, the team detailed the fixes bundled into the Austin hard fork on its Bor client and the Kyoto hard fork on its Heimdall client. Both were deployed following what Polygon described as standard practice for consensus-affecting fixes: rolling them out quietly and validating them on the Amoy testnet before mainnet activation, then going public once the network was safe.

The Austin fork closed two denial-of-service paths in block processing, including one where a malicious block producer could crash peer nodes by stuffing a block with an oversized data field.