Polygon discloses patched security flaws
Polygon has disclosed a set of security vulnerabilities that could have disrupted the reliability of its proof-of-stake network, saying the flaws were already fixed through two recently deployed hard forks. The advisory, released by Polygon Labs' Validators Support Team, described issues in both Bor and Heimdall, the core clients behind the Polygon PoS chain. The problems included denial-of-service risks, validator resource exhaustion, and failures or weaknesses affecting checkpoint and milestone processing.
The disclosure was made only after the fixes had been activated on mainnet. Polygon said the vulnerabilities were patched in protocol upgrades known as the Austin and Kyoto hard forks, which were deployed privately and tested before they went live. No exploits were observed on mainnet, according to the project, and the fixes were installed ahead of any public report.
What the vulnerabilities involved
The most severe issue described in the advisory involved Heimdall, Polygon's Tendermint-based validator and staking layer. A specially crafted transaction could force validators to perform excessive processing work, creating a risk of resource exhaustion and possible network disruption. In a proof-of-stake system, validators are responsible for proposing blocks, making checkpoints and advancing consensus, so any unexpected computational burden can lead to missed blocks, lagging nodes and delayed finality.
The advisory separately linked the Austin hard fork to two denial-of-service vulnerabilities in Bor, Polygon's block-producing client. These bugs could potentially slow down block processing or cause nodes to crash, making it harder for the network to maintain continuous operation. Denial-of-service attacks in blockchain networks aim to degrade availability rather than directly steal funds, but they can still be costly because they threaten the chain's normal function.
Polygon did not release full exploit code or detailed proof-of-concept material in the advisory. The descriptions were kept at a level high enough to inform node operators while reducing the chance that malicious actors could use the information to target unpatched systems. This approach is common for security teams that discover bugs through internal reviews or coordinated disclosure programs.
Why Heimdall and Bor both matter
Polygon PoS is not a single-client blockchain in the way Bitcoin or Ethereum has traditionally operated. It uses a two-layer design in which Heimdall and Bor perform distinct jobs. Heimdall acts as the proof-of-stake layer, coordinating validators and committing checkpoint data to Ethereum. Bor is responsible for producing blocks and executing transactions in an Ethereum-compatible environment. Together, the two layers allow Polygon to process transactions on a separate network while maintaining a security link to Ethereum.
Because the two layers are interdependent, a vulnerability in one can affect the other. A flaw in Bor that lets an attacker crash block producers could stop transaction throughput. A flaw in Heimdall could interfere with validator communication, checkpoint submission or milestone finality. That is why Polygon's disclosure treated client-level security as a critical operational issue, not simply as a smart-contract risk.
The mention of checkpoint and milestone processing is particularly important for users who depend on finality guarantees. Polygon uses checkpoints to periodically submit the state of the sidechain to Ethereum, which strengthens the network's security model. Milestones are designed to prevent chain reorganizations on the PoS network by giving users a deterministic finality point. A security flaw in this area could undermine one of Polygon's core selling points: fast finality with Ethereum security checks.
Hard forks and upgrade path
According to the disclosure, the Austin and Kyoto hard forks were not deployed as emergency responses to an active exploit. They were carried out privately, tested, and activated on mainnet before the security details were made public. This kind of deployment strategy gives validators time to update their software, but it also requires discipline. Once a hard fork is activated, all nodes must be running a compatible version of the software to participate in consensus.
Polygon said that nodes running older versions of either client past the hard fork activation heights have already fallen out of consensus. To rejoin the canonical network, operators must upgrade to the patched releases. Bor v2.10.0 is required for all Polygon PoS nodes, while Heimdall v0.11.0 is required for validators and full nodes. Both upgrades have already been active on mainnet, according to the team.
The upgrade instruction affects a wide range of participants, from independent validators to infrastructure providers and full-node operators. Validators that fail to upgrade may stop producing blocks and could miss rewards. Full nodes that are not in consensus may serve stale data to applications, which can lead to incorrect balances or outdated state if those applications depend on the node's view of the chain.
Security and disclosure after the fact
Polygon's decision to disclose the vulnerabilities after patching them is consistent with responsible security practice, but it still carries risks. Public details about a fixed bug can help other teams spot similar design weaknesses, but they can also give attackers information about the exact conditions that caused a failure. The safest window
Source: Cointelegraph News