Polygon Reports Security Flaws Patched in Latest Hard Forks

Polygon has published details of multiple previously undisclosed security vulnerabilities that could have affected its proof-of-stake (PoS) infrastructure, including issues spanning node-to-node denial-of-service risk and validator processing bottlenecks. Polygon said the problems were addressed ahead of public disclosure through two recent hard forks and corresponding client upgrades.

In a Thursday post on the Polygon forum, Polygon Labs’ Validators Support Team outlined how flaws in the Bor and Heimdall clients were fixed via the Austin and Kyoto hard forks. The disclosure also notes that none of the vulnerabilities have been observed exploited on Polygon mainnet.

Key takeaways

• Polygon disclosed vulnerabilities affecting both Bor and Heimdall clients, with potential denial-of-service and validator processing disruption.
• The issues were reportedly resolved through Austin (Bor) and Kyoto (Heimdall) hard forks, which were tested before activation.
• Polygon stated that no exploitation was observed on mainnet, and upgrades were deployed proactively before details became public.
• Running outdated client versions after hard fork activation heights means nodes will fall out of consensus and must upgrade to rejoin.
• Polygon requires Bor v2.10.0 for PoS nodes and Heimdall v0.11.0 for validators and full nodes.

What Polygon disclosed about the Bor client

According to Polygon’s disclosure, the Austin hard fork addressed two denial-of-service related risks tied to the Bor client. Denial-of-service flaws in blockchain clients are particularly concerning because they can degrade performance by increasing resource consumption during block handling, and in severe cases could contribute to node instability.

Polygon said these Bor issues could have impacted block processing or caused nodes to crash, depending on how an attacker might have triggered the problematic behavior. Polygon did not state that the vulnerabilities were exploited in the wild, but emphasized that the fixes were deployed in advance of the public release of technical details.

The Heimdall vulnerability that could overload validator processing

The disclosure highlighted a more severe problem affecting the Heimdall client. Polygon said a specially crafted transaction could force validators to perform excessive processing work. In a PoS environment, anything that causes disproportionate workload on validators can become a network reliability issue, since validators must process consensus-related data within practical performance limits.

Polygon framed the Heimdall flaw as one that could potentially disrupt network operation by pushing validators into an inefficient or overly burdensome processing path. The issue was addressed through the Kyoto hard fork, with corresponding updates rolled out before the information was disclosed publicly.

Hard fork mechanics and why upgrades matter

Polygon’s disclosure is explicit about the operational consequences for participants who do not update. Nodes running older versions of either Bor or Heimdall past the relevant hard fork activation heights are described as falling out of consensus and needing to upgrade to return to the canonical network.

Polygon stated that Bor v2.10.0 is required for all Polygon PoS nodes, and Heimdall v0.11.0 is required for validators and full nodes. Both upgrades are reported as already active on mainnet.

For infrastructure operators, this means security preparedness is also a liveness requirement: even if a node is not directly affected by an attack scenario, outdated software can still become unable to participate in consensus after protocol changes. In practice, the operational takeaway is to confirm client versions are aligned with the post-fork requirements and monitoring is in place to catch missed upgrades.

No evidence of mainnet exploitation, but a reminder on proactive patching

Polygon said none of the vulnerabilities described in the disclosure were observed being exploited on mainnet. The company also characterized the fixes as proactive—implemented through hard forks and client upgrades before the detailed vulnerability information was released.

This approach matters because it reduces the window in which real-world attackers could attempt to take advantage of known weaknesses. However, it also raises the bar for ongoing maintenance: even when the attack surface is addressed through upgrades, participants must still keep pace with protocol and client version changes to maintain connectivity and consensus participation.

At the time of writing, Polygon’s native token (POL)—formerly known as MATIC—was trading around $0.10. CoinGecko data shows it was down about 4% over the previous week, up 44% over the past month, and up 2.3% year to date, according to CoinGecko’s price statistics.

Readers should watch for operational confirmations from validators and node operators that their Heimdall and Bor upgrades remain stable post-fork. The next practical question is whether Polygon will publish additional details or guidance on mitigation practices beyond the required version upgrades—especially given that denial-of-service and validator workload vulnerabilities can be sensitive to implementation changes and monitoring thresholds.