Polygon Discloses Security Vulnerabilities Fixed in Austin and Kyoto Hard Forks

Polygon has disclosed multiple security vulnerabilities that remained unpublicized until their fixes had already been completed. The issues were resolved through two hard forks, Austin and Kyoto, and could affect Polygon’s proof-of-stake network. The vulnerabilities spanned the Bor and Heimdall clients, including denial-of-service risks, validator resource exhaustion, and problems tied to checkpoint and milestone processing. Polygon explained that each fix was tested privately before it was deployed to mainnet and before public disclosure. The most severe case was in Heimdall: specially constructed transactions could force validators into excessive processing work and disrupt the network. The Austin hard fork also fixed two denial-of-service risks in Bor, which could slow block processing or crash nodes. Polygon also confirmed that the vulnerabilities were not exploited on mainnet. The fixes had been completed proactively ahead of the public release of vulnerability details. No exploitation has been observed, Polygon said. The disclosure arrives after the fixes had already gone live on mainnet.