Polygon Patches Validator Overload and DoS Flaws in Austin, Kyoto Hard Forks

Polygon has revealed that two recent hard forks quietly eliminated a series of security vulnerabilities in its proof-of-stake network, including a flaw that could have allowed attackers to overwhelm validators with excessive computational work and trigger network-wide disruption.

The disclosure, published Thursday by Polygon Labs' Validators Support Team on the project's governance forum, details weaknesses in both the Bor execution-layer client and the Heimdall consensus-layer client. The fixes were shipped through the Austin and Kyoto hard forks before any technical specifics were made public, and Polygon said it has found no evidence that any of the vulnerabilities were exploited on mainnet.

The most severe issue resided in Heimdall. A specially crafted transaction could have forced validators into a processing path so burdensome that network operations would face a realistic risk of disruption. In a proof-of-stake system, anything that imposes disproportionate workload on validators becomes a reliability problem, since consensus participants must complete their duties within strict performance limits. The Kyoto hard fork, corresponding to the Heimdall v0.11.0 release, resolved that vector.

Separately, the Austin hard fork addressed two denial-of-service risks in the Bor client, which is responsible for block production on the network. Those flaws could have slowed block processing or caused nodes to crash outright, degrading throughput and availability even if the core consensus mechanism remained intact. Polygon also flagged bugs tied to checkpoint and milestone processing, components that keep state advancing consistently across epochs in PoS systems. Left unpatched, errors in those flows could cascade into broader failures.

The remediation followed a coordinated, private-first rollout. Polygon tested the upgrades before mainnet activation and withheld vulnerability details until the patches were already live, a standard responsible-disclosure pattern that limits the window in which a newly published flaw could be weaponized. The company framed the release as a completed patch rather than an active, unresolved threat.

For node operators, the operational consequences are immediate. Any node still running an older client version past the hard fork activation heights has fallen out of consensus with the canonical chain. Rejoining requires upgrading to Bor v2.10.0 for all Polygon PoS nodes and Heimdall v0.11.0 for validators and full nodes. Both versions are already active on mainnet, meaning lagging operators must act promptly to restore compatibility with post-fork network rules.

Independent security researchers were involved in identifying the issues. Nathan Worsley, a security researcher, publicly referenced work tied to the vulnerability on his X account, signaling that the flaws were significant enough to warrant an emergency response rather than a routine release. Polygon's disclosure also sits alongside one of the larger payouts in the ecosystem's history: a $2.2 million bounty documented in a bug-fix review, tied to a missing balance check that could have allowed value to be moved without corresponding funds existing.

The patch carries protocol-level significance because both Bor and Heimdall are core node software, touching the machinery that produces and finalizes Polygon blocks. The chain remains heavily used, hosting assets such as PayPal's PYUSD stablecoin, which raises the stakes for keeping node software current. Yet the disclosure also reopens a familiar tension around Polygon's security practices: prompt remediation on one hand, delayed public detail on the other. Users transacting during the exposure window could not weigh a risk they did not know existed.

Market reaction has been muted, with trading attention focused on token conditions rather than emergency risk. POL, formerly known as MATIC, was trading near $0.10 at the time of writing, down 4% over the past week but up 44% over the past month and 2.3% year to date, according to CoinGecko data.

The open question now is follow-through. A hard fork only closes a hole once a supermajority of validators run the patched client, making the upgrade as much a test of Polygon's coordination as of its code. Developers and validators will be watching the governance forum for post-fork stability reports and any additional detail on the flaws once the upgrade window closes. For ordinary users, no action is required once validators have adopted the patched software, since the change lives in the node layer rather than in wallets or approvals.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.