Polygon Patches Security Flaws in Two Hard Forks

Security Vulnerabilities Patched in Polygon Network via Hard Forks

Polygon Labs has announced the successful remediation of several security vulnerabilities within its proof-of-stake network. The fixes were implemented through two hard forks, Austin and Kyoto, which were deployed privately before public disclosure.

In a forum post released on Wednesday, the Polygon team outlined the patches integrated into the Austin hard fork for its Bor client and the Kyoto hard fork for its Heimdall client. These updates followed Polygon’s established protocol for addressing consensus-critical fixes: a quiet rollout and validation on the Amoy testnet prior to mainnet activation, with public announcement only after the network’s security was confirmed.

The Austin fork specifically addressed two denial-of-service vulnerabilities in block processing. One of these allowed a malicious block producer to potentially crash peer nodes by submitting a block containing an excessively large data field.

The Kyoto fork tackled a broader range of issues aimed at strengthening network consensus. The most critical of these involved a flaw that could have enabled an attacker to compel the entire validator set to perform costly, coordinated work through a single, inexpensive transaction that would have been expensive for the network to process.

Polygon emphasized that no evidence suggests these vulnerabilities were exploited on the mainnet, and all were resolved proactively. Both upgrades are now mandatory for node operators and are currently active, requiring no state migration or resynchronization.

These disclosures come at a significant juncture for Polygon, which recently completed the migration of its legacy MATIC token to POL as part of a comprehensive network architecture overhaul.

The announcement had a limited impact on the price of POL. According to CoinGecko, the token was trading around $0.09983 on Sunday, marking a 2.3% decrease over the preceding 24 hours. Over the past week, POL has declined by approximately 6.8%, and its year-to-date performance shows a drop of about 60.8%. Despite these recent trends, the token maintains a market capitalization close to $1.07 billion, reflecting gains over the past month.