Polygon fixes validator security flaws with Austin and Kyoto forks
Polygon Labs has patched several security flaws across its proof-of-stake network through two coordinated hard forks, including a vulnerability that could have forced the full validator set to perform costly processing from a single crafted transaction. Polygons Validators Support Team disclosed the fixes in an Aug. 27 forum post after the Austin and Kyoto hard forks had already been tested and activated. The team said consensus-affecting security fixes were deployed privately, validated on the Amoy testnet and disclosed only after the mainnet fleet was protected. The vulnerabilities affected Bor, Polygon PoSs execution client, and Heimdall, which handles validator coordination and other consensus functions. Polygon said it found no evidence that any of the issues had been exploited or caused disruption on mainnet. Polygon hard forks close block processing flaws The Austin hard fork upgraded Bor to version 2.10.0 and addressed two denial-of-service paths tied to block processing. One involved state-sync events used for L1-to-L2 bridge deposits. Such events can execute contract code and precompiles, but their execution was not subject to an effective per-block gas bound. Austin introduced a limit on how much gas state-sync events can consume within a block, preventing them from exhausting processing resources. A separate weakness involved TxDependency data used during block









