Polygon Labs has publicly released Bor v2.1.3 after previously distributing the build privately to validators and major infrastructure providers. The update fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution, both of which were reported by security researchers through the Immunefi bug bounty program. One issue involved an unbounded keccak256 cache that could let a crafted transaction fill hundreds of MiB during speculative execution, potentially exhausting node memory and delaying block production. The second involved repeated code-hash computation during parallel execution, where a single transaction could keep the parallel processor busy for about 11 seconds and hurt node liveness. The release also includes several internal hardening changes, including added mempool address filtering for EIP-7702 SetCode authorizations, a fix to RPC batch execution pool concurrency limits, a consistency fix for balance reads across self-destruct boundaries in parallel execution, and automatic cleanup of stuck pending transactions after a default of three hours. Polygon Labs said the affected versions were Bor v2.1.1 and v2.1.2. Version 2.1.3 is not a hard fork, so nodes can be upgraded one by one without coordination. The company also said there was no record of either vulnerability being exploited on mainnet or on the Amoy testnet.
Polygon Labs said Bor v2.1.3 is now publicly available after the release had earlier been distributed privately to validators and major infrastructure providers.
Two medium-severity denial-of-service issues fixed
The update fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution. Both were submitted by security researchers through the Immunefi bug bounty program.
The first issue involved an unbounded keccak256 cache. According to the announcement, an attacker could craft a specific transaction that filled hundreds of MiB of cache during speculative execution, which could exhaust node memory and delay block production. The fix sets a capacity limit on the shared cache.
The second issue involved repeated code-hash computation during parallel execution. A single transaction could cause the parallel processor to spend about 11 seconds on processing, seriously affecting node liveness. The fix adds per-transaction caching for code hash results.
Additional internal hardening included
Bor v2.1.3 also includes several internal hardening measures:
- mempool address filtering now blocks EIP-7702 SetCode authorizations;
- a fix for RPC batch execution pool concurrency limits;
- a consistency fix for balance reads across self-destruct boundaries in parallel execution;
- automatic cleanup for stuck pending transactions, with a default window of 3 hours.
Affected versions and upgrade path
Polygon Labs said Bor v2.1.1 and v2.1.2 were the affected versions. Bor v2.1.3 is not a hard fork, which means nodes can be upgraded individually without coordination.
The company added that it found no record of either vulnerability being exploited on mainnet or on the Amoy testnet.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
