preferred on
Points of Focus
- Polygon disclosed 10 fixes weeks after quietly deploying them on mainnet.
- One bug let an oversized block field crash any node that received it.
- Unpatched nodes are now both off-consensus and running documented flaws.
Polygon disclosed 10 distinct fixes across two coordinated hard forks on Aug. 27, weeks after quietly deploying and activating both on mainnet. Austin patched its Bor execution client to version 2.10.0.
🚨 Polygon fixed multiple serious DoS vulnerabilities through recent hard forks before the issues were publicly disclosed. No exploits were reported, but the bugs could have disrupted parts of the network if left unpatched. pic.twitter.com/aCkEhEkPmT
— DustyBC Crypto (@DustyBC) August 30, 2026
Kyoto patched its Heimdall consensus client to version 0.11.0. Technical details reached the public only once the entire validator fleet was already protected, a sequencing Polygon states as deliberate policy for any fix that affects consensus, not an improvised response to a live incident.
Polygon’s Bor fix closed a bug that could crash any node
Austin addressed two separate issues in Bor.
- The first closed an unmetered gas cost for state-sync events, the mechanism handling deposits bridged from Ethereum to Polygon, which previously could make block processing slow enough to transiently stall the chain if enough expensive events landed in one block.
- The second, more severe, removed a block field called “TxDependency” entirely. That field carried parallel-execution hints with no size limit attached, meaning a block producer could attach an arbitrarily large blob to an otherwise valid block, and any peer node receiving it would crash attempting to process it.
Polygon’s Heimdall fix stopped a validator-wide overload attack
Kyoto bundled eight separate fixes into Heimdall, the most severe of which closed a nested-message decoding flaw.
Heimdall transactions wrap inner messages inside a type that can nest inside itself without limit, so a single, cheap-to-construct transaction with deeply nested fields could force every validator to perform a large amount of decode work simultaneously, an asymmetric attack where what it costs an attacker to build and what it costs the network to process are wildly mismatched.
The fix enforces an identical nesting limit at both initial mempool admission and final consensus processing, specifically closing a gap where the same transaction could otherwise pass one stage and fail the other.
A separate, more subtle fix addressed a case where two distinct events originating on Ethereum could hash to the same internal replay key inside Heimdall, letting one silently shadow the other, a data-integrity bug rather than an attack vector — evidence this batch covered correctness cleanup alongside security hardening.
Why coordinated disclosure is standard practice in blockchain security
Fixing consensus-affecting bugs privately before disclosing them is common practice across major blockchains, not a Polygon-specific choice.
BNB Chain followed the same pattern days earlier, patching a duplicate-validator-signature bridge vulnerability through its Pasteur hard fork before detailing what it had fixed. The logic is consistent across both cases: Publishing exploit mechanics before every node is protected gives attackers a working blueprint against whichever operators haven’t upgraded yet.
What unpatched Polygon nodes are running now
That logic cuts both ways once disclosure happens.
Any node still running pre-hardfork software past the stated activation heights — mainnet block 91,949,700 for Austin and height 51,533,000 for Kyoto — has already fallen out of consensus entirely.
Polygon’s post specifies that recovery isn’t a simple version bump: An affected node needs to upgrade and roll back to a pre-hardfork height to resync and rejoin the canonical network. Every operator in that position is now running software with publicly documented, reproducible flaws, a direct consequence of the same disclosure timing that protected the rest of the network while it was still exposed.
Share
Most read articles
