Polygon has disclosed several previously private security vulnerabilities that could have disrupted its proof-of-stake network, after deploying fixes through two recent hard forks. The vulnerabilities affected Polygon's Bor and Heimdall clients and included denial-of-service risks, validator resource exhaustion and flaws affecting checkpoint and milestone processing, according to a Thursday disclosure from Polygon Labs' Validators Support Team.
The flaws were fixed through the Austin and Kyoto hard forks, which were deployed privately and tested before being activated on mainnet and publicly disclosed. The most severe issue involved Heimdall, where a specially crafted transaction could force validators to perform excessive processing work, potentially disrupting the network. The Austin hard fork separately addressed two denial-of-service risks in Bor that could have slowed block processing or caused nodes to crash. None of the vulnerabilities were observed being exploited on mainnet, according to Polygon, which said the fixes were deployed proactively before details were made public.
Understanding Polygon's two-layer architecture
Polygon PoS is one of the most widely used scaling solutions on Ethereum, designed to offer faster and cheaper transactions while inheriting the security properties of the underlying Ethereum network. The system relies on two separate client components working together: Bor and Heimdall. Bor is the block-producing layer, sometimes referred to as the sidechain, where transactions are collected into blocks by selected validators. Heimdall is the consensus and checkpointing layer, built on a Tendermint-based engine, that coordinates validators, staking, checkpoints and milestone updates.
Checkpoints are periodic hashes of Polygon block data that are submitted to Ethereum to anchor the sidechain state. Milestones provide quicker assurance for users that a particular batch of blocks is final and cannot be reverted. Any issue that compromises these processes can undermine trust in the network and create risks for validators and applications built on top of Polygon. The vulnerabilities disclosed this week were specifically tied to how Bor and Heimdall processed certain inputs, making them a target for denial-of-service and resource exhaustion attacks.
The disclosed vulnerabilities
Polygon said the most severe vulnerability was found in Heimdall. A specially crafted transaction could force validators to perform excessive processing work, potentially exhausting their computational resources and disrupting the network. Validators on Polygon are responsible for producing blocks, attesting to checkpoints and maintaining the security of the chain. If an attacker could force validators to run unnecessary operations, the network could slow down, stall or become temporarily unavailable. The fix for this issue was included in the Kyoto hard fork.
The Austin hard fork addressed two distinct denial-of-service risks in Bor. One could have slowed block processing, causing delays and potentially leading to missed blocks or a backlog of pending transactions. The other could have caused nodes to crash, which would remove them from the network and reduce the validator set. Together, the two flaws represented a significant availability risk. However, Polygon said none of the vulnerabilities were actively exploited on mainnet, and the patches were applied proactively.
How the hard forks were deployed
A particularly important detail in Polygon's disclosure is the order of operations. The Austin and Kyoto hard forks were not first announced and then deployed. Instead, the fixes were implemented in code, tested privately and activated on mainnet before the vulnerabilities were publicly described. This kind of responsible disclosure is common in the blockchain industry because publicizing vulnerabilities before a patch is ready can give malicious actors a blueprint for attack.
Polygon's Validators Support Team worked with node operators and validators to coordinate the upgrades across the network. By the time the disclosure was published, the upgrades had already been active on mainnet for enough time to establish canonical chain state. This meant that any node running an older version of Bor or Heimdall past the hard fork activation height would fall out of consensus automatically. Polygon warned that such nodes must upgrade to rejoin the canonical network.
Upgrade requirements
According to the disclosure, Bor v2.10.0 is required for all Polygon PoS nodes, while Heimdall v0.11.0 is required for validators and full nodes. Both upgrades are already active on mainnet. Node operators who have not yet applied the upgrades are outside consensus and need to do so immediately to resume normal operation. Validators face an additional obligation because they are part of the network's security layer. Running outdated software could not only disrupt their own service but also expose them to potential penalties if they fail to participate correctly.
This is not the first time Polygon has had to issue urgent client updates. The network has undergone a series of upgrades since its launch to improve performance, adjust tokenomics and address security issues. The Austin and Kyoto hard forks continue that pattern, with an emphasis on keeping the validator infrastructure healthy. The fact that no exploits were observed before the patches went live is a positive sign, but the disclosure also highlights the importance of timely upgrades.
Security in the broader blockchain ecosystem
Denial-of-service and resource exhaustion attacks have been a persistent concern across many proof-of-stake networks. Validators often run their nodes on cloud infrastructure with limited CPU and memory. A single malicious transaction that causes excessive resource consumption can halt a validator, and if enough validators are affected, the entire network may stop producing blocks. Attackers may also target checkpoint and milestone messages to create confusion among users and applications about the canonical state of the chain.
Polygon's decision to disclose the vulnerabilities after patching them is aligned with best practices in the industry. Many protocols have adopted bug bounty programs and coordinated disclosure processes to encourage researchers to report issues privately. Polygon runs its own bug bounty program and has previously credited external researchers for findings. By maintaining a structured path for reporting vulnerabilities, the project can reduce the risk of attacks while still keeping the community informed about potential risks.
POL token market context
POL, Polygon's native token formerly known as MATIC, was trading around $0.10 at the time of writing. The token was down about 4% over the past week, but up 44% over the past month and 2.3% year to date, according to CoinGecko data. The price movements suggest that the security disclosures did not trigger a major selloff, perhaps because the vulnerabilities were already patched before the public announcement.
Broader market conditions and developments across the Polygon ecosystem may have played a larger role in POL's recent price action than the hard fork disclosures. Many cryptocurrencies have seen increased volatility as investors react to changes in interest rates, regulatory news and network activity. For Polygon, the successful deployment of the security fixes could actually be seen as a strengthening factor, since it demonstrates that the network is actively maintained and capable of responding to threats.
The network upgrade requirements apply not only to validators but also to full nodes and infrastructure providers running Polygon PoS. Services such as RPC providers, indexers and exchanges that rely on Polygon data must ensure they are running the correct versions of Bor and Heimdall. Failing to do so could cause these services to read an outdated chain or, more seriously, submit invalid state to applications. Polygon's disclosure did not name any affected services, but the warning was clear: all node operators should upgrade promptly.
Polygon's core team will continue to monitor the network after the hard forks for any signs of instability or attempted exploitation. The disclosure was meant to inform users and operators about the nature of the patched issues and to reinforce the need for consistent software maintenance. With the upgrades now live, the immediate security risk has been addressed, but the broader lesson remains important for every proof-of-stake ecosystem: security is an ongoing process, and node hygiene is a critical part of network resilience.
Source:Cointelegraph News