Polygon discloses vulnerability details: multiple undisclosed security vulnerabilities have been fixed

Polygon disclosed multiple previously undisclosed security vulnerabilities recently fixed through two hard forks, Austin and Kyoto, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial-of-service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.

Polygon stated that the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most severe issue involved Heimdall, where carefully crafted transactions could force validators to perform excessive processing work, disrupting the network. The Austin hard fork also fixed two denial-of-service risks in Bor that could slow down block processing or cause node crashes. Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively completed before the details of the vulnerabilities were made public.