Polygon Labs releases hard forks to fix network security flaws

Polygon Labs has released two hard forks, named Kyoto and Austin, to address security vulnerabilities within its proof-of-stake (POS) network. These updates are mandatory for all node operators to maintain network consensus.

The Kyoto hard fork addresses a critical flaw in Heimdall, the software coordinating Polygon validators. The vulnerability involved nested protobuf fields, which allowed an attacker to create a single, low-cost transaction with infinite layers of wrappers. This forced validators to waste significant computing power unpacking the data, a flaw Polygon described as “a permissionless way to force costly, correlated work across the whole validator set.” The fix introduces a byte-level pre-scan to reject transactions that exceed nesting thresholds.

The Austin hard fork targets Bor, the network's execution client, to patch two denial-of-service paths. It implements a hard per-block limit on state-sync gas to prevent uncapped gas consumption during L1-to-L2 bridge deposits. Additionally, it removes the TxDependency field, which previously allowed attackers to crash nodes by loading the field with excessive data.