Polygon Patches Critical Network Vulnerabilities via Hard Forks

The vulnerabilities targeted Bor, the network's execution client, and Heimdall, which governs consensus functions. According to the Polygon Validators Support Team, the patches were developed and tested on the Amoy testnet before being activated on the mainnet. These fixes were disclosed publicly on August 27 only after the network was fully protected. No evidence suggests these flaws were exploited on the mainnet prior to the upgrades.

The Austin fork, which upgraded Bor to version 2.10.0, implemented gas limits for L1-to-L2 bridge deposits to prevent resource exhaustion and addressed a vulnerability involving TxDependency data that could have caused memory crashes. Simultaneously, the Kyoto fork updated Heimdall to version 0.11.0, introducing a critical byte-level scan for nested protobuf fields. This prevents attackers from forcing validators into excessive decoding loops. Both updates are mandatory for node operators, as those running older software have already deviated from the canonical chain and must perform a binary upgrade to reconnect.