Polygon disclosed a security vulnerability fix from a recent hard fork

Polygon disclosed multiple previously undisclosed security vulnerabilities that were recently fixed through two hard forks, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial of service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.

Polygon stated that these vulnerabilities were fixed through the Austin and Kyoto hard forks, and the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most serious issue involved Heimdall, where a carefully crafted transaction could force validators to perform excessive processing work, thereby disrupting the network. The Austin hard fork also fixed two denial of service risks in Bor that could slow down block processing or cause node crashes.

Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively deployed before the details were made public. Nodes running outdated client versions have fallen out of consensus after the hard fork activation height and must upgrade to rejoin the standard network. All Polygon PoS nodes are required to upgrade to Bor v2.1.0, and validators and full nodes must upgrade to Heimdall v0.11.0, both upgrades are now effective on the mainnet.