Polygon has completed two important hard fork upgrades, Austin and Kyoto, to address several security vulnerabilities affecting its Polygon PoS network. The upgrades focused on preventing denial-of-service attacks, strengthening transaction validation, and improving the overall reliability of the network.
According to Polygon’s Validators Support Team, the security fixes were disclosed on August 27 after the upgrades had already been tested and activated. Polygon followed a security-first approach by privately deploying the fixes, validating them on the Amoy testnet, and waiting until the mainnet validator fleet was protected before publicly revealing technical details.
Polygon emphasized that there was no evidence that any of the vulnerabilities had been exploited on mainnet. However, node operators are now required to run the upgraded versions following the hard forks.
Austin Hard Fork Addresses Block Processing Risks
The Austin hard fork upgraded Polygon’s Bor execution client to version 2.10.0. Bor is responsible for processing transactions and blocks on Polygon PoS.
One of the vulnerabilities involved state-sync events, which are used for activities such as transferring information from Ethereum to Polygon. These events can execute contract code and precompiles. Previously, their processing was not protected by an effective per-block gas limit.
An attacker could potentially exploit this behavior to consume excessive processing resources and create a denial-of-service condition. The Austin upgrade introduced a limit on the amount of gas that state-sync events can consume within a block. This helps prevent malicious activity from exhausting the resources of network nodes.
The second issue involved TxDependency data used during block processing. A malicious block producer could potentially submit an oversized data field that would cause excessive memory allocation on nodes processing the block. In extreme cases, this could cause peer nodes to crash.
Polygon classified both issues as block-processing denial-of-service vulnerabilities rather than consensus-correctness problems. The network reported no known mainnet disruption caused by either vulnerability.
Kyoto Hard Fork Improves Validator Protection
The Kyoto hard fork upgraded Heimdall to version 0.11.0. Heimdall plays an important role in Polygon PoS by coordinating validators and handling consensus-related operations.
One of the most serious issues addressed by Kyoto involved deeply nested google.protobuf.Any fields. Heimdall transactions can contain messages wrapped inside any fields, and those fields can be nested repeatedly.
Without a suitable depth restriction, an attacker could create a relatively inexpensive transaction containing extremely deep nesting. Every validator processing the transaction could then be forced to perform significant decoding work.
This created a potential way for an attacker to impose costly processing requirements across Polygon’s validator set without needing special permissions.
The Kyoto upgrade introduced a byte-level scanning mechanism that rejects transactions when nesting exceeds a defined threshold. Importantly, the protection operates at both the mempool admission stage and the consensus processing stage. This prevents inconsistent behavior where a transaction might pass through one stage but be rejected at another.
Additional Heimdall Security Improvements
Kyoto also introduced several other improvements related to milestone accounting, checkpoint processing, and L1 event replay.
For example, failed future-span creation can now degrade and retry at the next boundary instead of blocking a milestone commit. Polygon also introduced new replay keys to handle an edge case where different L1 events could potentially collide.
These changes may appear technical, but they are important for maintaining the stability of a blockchain network. Validators must process large amounts of data consistently, and even a small weakness in transaction handling can potentially become a major problem when exploited at scale.
Why These Upgrades Matter for Polygon
Security upgrades are particularly important for blockchain networks because they operate continuously and rely on distributed participants to process transactions. A vulnerability that causes validator crashes, excessive resource consumption, or inconsistent transaction processing could negatively affect network availability.
Polygon’s decision to fix the vulnerabilities privately before publicly disclosing them also highlights the importance of responsible security disclosure. By testing the patches on the Amoy testnet and protecting mainnet nodes before releasing technical details, Polygon reduced the risk that attackers could exploit the vulnerabilities after learning about them.
The Austin and Kyoto hard forks demonstrate that blockchain security is an ongoing process. Networks must continuously review their execution clients, validator infrastructure, transaction processing systems, and consensus mechanisms as new attack vectors emerge.
Polygon has stated that none of the vulnerabilities were exploited on mainnet. With the Austin and Kyoto upgrades now mandatory for node operators, the network has taken another step toward improving the resilience and security of Polygon PoS.
Conclusion
Polygon’s Austin and Kyoto hard forks represent significant security improvements for the Polygon PoS ecosystem. Austin focused primarily on block-processing denial-of-service risks in Bor, while Kyoto strengthened Heimdall against malicious transaction inputs and excessive validator processing.
Although the vulnerabilities reportedly did not lead to known mainnet exploitation, addressing them before public disclosure helped protect the network and its validators. The upgrades also show why regular security reviews and protocol improvements are essential for blockchain infrastructure.
As Polygon continues to evolve, maintaining strong validator protection, efficient transaction processing, and reliable consensus mechanisms will remain critical to the network’s long-term growth and adoption.
