Polygon Labs has revealed that it patched a batch of security vulnerabilities in its proof-of-stake network through two hard forks that were rolled out privately before being disclosed publicly.
In a forum post, the team detailed the fixes bundled into the Austin hard fork on its Bor client and the Kyoto hard fork on its Heimdall client. Both were deployed following standard practice for consensus-affecting fixes: rolling them out quietly and validating them on the Amoy testnet before mainnet activation, then going public once the network was safe.
Nature of the Vulnerabilities
The Austin fork closed two denial-of-service paths in block processing, including one where a malicious block producer could crash peer nodes by stuffing a block with an oversized data field.
The Kyoto fork addressed a larger set of consensus-hardening issues, the most severe being a flaw that would have let an attacker force costly, coordinated work across the entire validator set using a single crafted transaction, cheap to build but expensive for the network to process.
Polygon stressed that none of the flaws were observed being exploited on mainnet and that all were resolved proactively. Both upgrades are now mandatory for node operators and are already active, requiring no state migration or resync.
Market Context
The disclosures come during a pivotal period for Polygon, which completed the migration of its legacy MATIC token to POL as part of a broader overhaul of its network architecture. POL was trading around $0.09983, down 2.3% over 24 hours.
