Polygon Labs has successfully patched multiple security vulnerabilities across its proof-of-stake network through coordinated hard forks, with no known exploitation reported. According to reports from Decrypt and Cointelegraph, the Austin fork upgraded Bor to version 2.10.0 and addressed two denial-of-service paths, while the Kyoto fork moved Heimdall to version 0.11.0 and covered input-validation and consensus-hardening fixes. The company revealed these previously private security vulnerabilities after deploying fixes through the Austin and Kyoto hard forks, allowing developers to test the patches and activate them without giving potential attackers advance notice. Polygon confirmed it found no evidence that attackers exploited the flaws on mainnet before the disclosure, with the fixes being preventive measures rather than responses to actual incidents. The vulnerabilities primarily threatened network availability/liveness rather than directly allowing attackers to steal POL or user assets, highlighting the importance of validator resource exhaustion as a critical security risk often overlooked in blockchain evaluations.
The Austin hard fork introduced critical block processing safeguards to prevent denial-of-service attacks. As reported by Polygon Labs, one vulnerability involved state-sync operations from Ethereum to Polygon, which could execute contract code and consume gas without strict per-block limits. Austin introduced a gas consumption limit for state-sync events, preventing them from exhausting processing resources. Additionally, the fork addressed a separate weakness in TxDependency data used during block processing, where malicious block producers could supply oversized data fields causing excessive memory allocation and potentially crashing peer nodes. The Austin upgrades were tested before activation on mainnet to ensure proper functionality, with the company removing the unbounded TxDependency field from the format transmitted between nodes to prevent potential crashes. The Austin Hard Fork was deployed together with Bor v2.10.0, addressing two denial-of-service attack paths that could slow block processing or cause nodes to crash.
The Kyoto hard fork implemented more comprehensive security measures, particularly addressing a severe vulnerability in deeply nested google.protobuf.Any fields. According to Polygon Labs, this flaw allowed attackers to construct transactions containing nested fields at relatively low cost while forcing every validator to perform substantial decoding work. The Kyoto upgrade introduced a byte-level scan that rejects transactions once nesting exceeds a defined threshold, with checks applied at both mempool admission and consensus processing stages. Other Heimdall fixes covered milestone accounting, checkpoint processing, and L1 event replay functionality. The most serious issue affected Heimdall, where a specially crafted transaction could force validators to perform excessive decoding work, potentially placing significant pressure on validators and disrupting network operations. The update also fixed a fee list that could previously become extremely long, preventing users from causing unnecessary resource consumption. The Kyoto hard fork was deployed as a Heimdall hardening upgrade rather than a patch for a single bug, with the most notable vulnerability being the ability for a crafted transaction to force the entire validator set to perform large amounts of computation from a relatively inexpensive input.
Both hard forks are mandatory for operators wanting to remain on the canonical Polygon PoS network, with different requirements for different node types. As reported by Polygon Labs, Bor v2.10.0 is required for all nodes, while Heimdall v0.11.0 applies to validators and full nodes. The company confirmed that nodes running older client versions after the relevant activation heights have fallen out of consensus and must upgrade to reconnect with the canonical Polygon network. The changes were delivered as binary upgrades, meaning operators do not need to migrate state or perform full resync operations. Both versions are already active on mainnet following successful deployment, with operators remaining on old versions after activation heights no longer following the canonical chain and requiring software updates and resynchronization. According to Cointelegraph, nodes still running older client versions past the hard fork activation heights have reportedly fallen out of consensus and cannot rejoin the canonical chain until they upgrade, with node operators who have not yet applied both upgrades effectively running on a forked, non-canonical version of the network.
POL token showed minimal reaction to the security disclosure, with the token trading around $0.10 at the time of the reports, down approximately 4% over the prior week but up 44% over the prior month and 2.3% year to date, according to CoinGecko data cited by Cointelegraph. This price figure appears in only one of the two reports reviewed, so it should be treated as a snapshot from that specific timestamp rather than a confirmed cross-source data point. The token remains about 60.8% lower than a year earlier, giving it a market capitalization of roughly $1.07 billion. This security enhancement follows Polygon's previous hard fork in September 2025, which addressed transaction finality delays of up to 15 minutes, and the Rio mainnet upgrade in October 2025 that introduced witness-based stateless validation. The disclosure highlights the importance of proactive security response rather than reactive measures, as Polygon discovered and patched the vulnerabilities before any exploitation occurred. The event demonstrates that blockchain security extends beyond asset theft to include network availability, with the biggest impact being on assessment of engineering quality and security processes rather than direct token economics. For a blockchain aiming to become financial infrastructure, availability is equally important as asset protection, as a payment network cannot simply say "you can use your money when you need it."
