Polygon Completes Two Hard Forks To Fix Security Flaws Before Revealing Vulnerabilities To The Public

Polygon Labs has revealed that several security vulnerabilities in its proof-of-stake network had already been fixed before details of the flaws were made public.

The issues affected Polygon’s Bor and Heimdall clients and were resolved through two hard forks, Austin and Kyoto, which were deployed privately before the disclosures were released.

Austin Hard Fork Closed Two Denial-Of-Service Risks

The Austin hard fork focused on Polygon’s Bor client, which handles execution and block processing.

It fixed two denial-of-service vulnerabilities that could have disrupted nodes when processing maliciously crafted blocks.

One of the flaws could allow a malicious block producer to crash peer nodes by inserting an oversized data field into a block.

The other vulnerability could place excessive computational demands on nodes, potentially slowing down block processing and affecting network performance.

Polygon deployed the fixes after testing them on the Amoy testnet, following its usual approach for security issues that could affect consensus or network operations.

Kyoto Addressed A More Serious Validator Resource Risk

The Kyoto hard fork dealt with a broader group of vulnerabilities in Heimdall, the client responsible for validator coordination and other consensus-related processes.

The most serious issue involved a specially crafted transaction that could force the entire validator set to carry out expensive processing.

The transaction itself could be relatively cheap for an attacker to create, while the work required from validators could be far more costly.

That created a potential resource-exhaustion attack, where repeated or carefully constructed inputs could consume validator resources and interfere with network operations.

Polygon added limits to prevent transactions that require processing beyond expected thresholds from being accepted.

Kyoto also addressed weaknesses connected to checkpoint and milestone processing, further hardening parts of the network responsible for coordinating consensus activity.

Polygon Says No Vulnerability Was Exploited On Mainnet

Polygon said none of the vulnerabilities had been observed being exploited on its mainnet.

Instead, the flaws were fixed proactively, with the technical details disclosed only after the upgrades had been deployed and the network was considered safe.

The private rollout was intended to limit the window in which attackers could learn about the vulnerabilities while nodes were still exposed.

Both hard forks are now active and mandatory for node operators.

Polygon said they do not require a state migration or network resync.

Source: Polygon

The Fixes Come During Polygon’s Wider Network Overhaul

The security disclosures arrive as Polygon continues a broader overhaul of its network architecture.

The network has completed the migration from its legacy MATIC token to POL, adding another major change to Polygon’s infrastructure alongside the recent client upgrades.

The vulnerabilities also show how attacks on proof-of-stake networks can extend beyond direct theft of funds.

A flaw that crashes nodes, slows block processing or forces validators to perform excessive work can disrupt network availability even when no assets are directly compromised.