Polygon Labs: Bor v2.1.3 released, fixing two DoS security vulnerabilities

Polygon Labs official announcement, Bor v2.1.3 is officially released to the public, previously distributed in private version form to validators and major infrastructure providers. This update fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution, both submitted by security researchers through the Immunefi bug bounty program.

Unbounded keccak256 cache issue: Attackers can fill hundreds of MiB of cache during the speculative execution phase by constructing specific transactions, leading to node memory exhaustion and delayed block production. The fix is to set a capacity limit on the shared cache. Repeated code hash calculation issue in parallel execution: A single transaction can cause the parallel processor to take about 11 seconds, severely affecting node activity. The fix is to cache code hash results on a per-transaction basis.

In addition, this update also includes several internal hardening measures: the transaction pool address filtering adds interception for EIP-7702 SetCode authorization, RPC batch execution pool concurrency limit fixes, consistency fixes for reading balances across self-destruct boundaries in parallel execution, and an automatic cleanup mechanism for pending transactions (default 3 hours). The affected versions are Bor v2.1.1 and v2.1.2. v2.1.3 is a non-hard fork, and nodes can upgrade individually without coordination. No exploitation records of the two vulnerabilities have been found on the mainnet and testnet Amoy.