Polygon Crypto has implemented two coordinated hard forks, named Austin and Kyoto, to address critical security vulnerabilities in its Bor and Heimdall clients. These upgrades, designed to mitigate denial-of-service, resource-exhaustion, and consensus-hardening risks, were deployed privately and validated on the Amoy testnet before being activated on the mainnet, according to a Polygon forum post published August 27.
The Austin hard fork, integrated into Bor client version v2.10.0, resolved two denial-of-service vectors. Firstly, it introduced an explicit per-block gas bound for state-sync events, which previously lacked metering and could potentially cause temporary chain stalls. Secondly, Austin removed Bor’s TxDependency wire field, an unbounded hint for parallel execution that posed a risk of crashing block-processing peers.
Concurrently, the Kyoto hard fork, applied to Heimdall client version v0.11.0, targeted consensus-edge-case risks. Its primary focus was on deeply nested google.protobuf.Any fields within Heimdall transactions. To prevent potential exploitation where a single transaction could impose disproportionately high decode work on all validators, Kyoto now enforces a byte-level pre-scan for these fields at both mempool admission and on the consensus path.
Kyoto also incorporated several smaller hardening fixes, including a cap on fee-coin counts and normalized checkpoint signature recovery bytes, contributing to overall protocol resilience. These layered validation hardening measures align with broader industry efforts to secure transaction-processing edge cases.
Both hard forks were activated on the Amoy testnet and Polygon PoS mainnet prior to the public disclosure. Austin activated at Amoy block 44,120,000 and mainnet block 91,949,700, while Kyoto activated at Amoy height 42,252,000 and mainnet height 51,533,000.
Participation in these upgrades is mandatory for network integrity. Bor v2.10.0 is required for all nodes, and Heimdall v0.11.0 is mandatory for all validators and full nodes. These are plain binary upgrades, meaning operators already running current versions do not require state migration or genesis changes. However, nodes operating on pre-fork binaries past the activation heights have diverged from canonical consensus and must upgrade and roll back to resync.
Polygon Crypto clarified that the vulnerabilities addressed were primarily resource-exhaustion and consensus-edge-case risks, rather than fundamental correctness failures. Crucially, no mainnet disruption or exploitation was observed in connection with these issues. The network’s security management approach involved fixing the issues, confirming fleet safety, and then disclosing the details.
This proactive and private deployment of critical security patches by Polygon Crypto underscores a commitment to maintaining network integrity and stability, effectively mitigating potential risks before they could impact the network.
Why This Matters
The materials describe a narrow update: Polygon Crypto implemented two coordinated hard forks, Austin (Bor v2. The exact nature and severity of potential exploits if the vulnerabilities had not been patched.
Broader Context
Source materials place the factual news in this context: Polygon Crypto deployed two coordinated hard forks , Austin on Bor v2.10.0 and Kyoto on Heimdall v0.11.0, to close denial-of-service, resource-exhaustion and consensus-hardening risks across its Polygon PoS client stack.
Leave a Reply