Polygon Fixes Security Vulnerabilities via Two Hard Forks, Privately Deployed Earlier

Polygon Labs disclosed that it fixed a batch of security vulnerabilities in its proof-of-stake network via two hard forks, with the fixes having been privately deployed before public disclosure. According to a forum post Wednesday, the team packaged the fixes into the Austin hard fork for the Bor client and the Kyoto hard fork for the Heimdall client, both following the standard process for consensus-affecting fixes: first validated on the Amoy testnet, then publicly disclosed only after mainnet activation and network security were confirmed. The Austin fork addressed two denial-of-service vectors in block processing, including a vulnerability where a malicious block producer could crash peer nodes by populating oversized field data. The Kyoto fork handled broader consensus hardening, with the most severe flaw allowing an attacker to force the entire validator set to perform expensive, coordinated work with just a single crafted transaction—cheap to construct but costly for the network to process. Polygon emphasized that no exploits were observed on mainnet for any of the vulnerabilities and that they have been proactively resolved; both upgrades are now mandatory for node operators and have taken effect without requiring state migration or resynchronization. The disclosure comes during a critical transition for Polygon, which has completed migrating its legacy MATIC token to POL as part of a comprehensive network architecture overhaul. The news did not boost POL's price, which traded at approximately $0.09983 on Sunday, down 2.3% over 24 hours, down about 6.8% over the past week, and down roughly 60.8% over the past year, with a market cap of approximately $1.07 billion, according to CoinGecko data.