Polygon patches denial-of-service flaws in Austin and Kyoto hard forks

Polygon fixes critical network vulnerabilities

Polygon has disclosed several security vulnerabilities that could have disrupted its proof-of-stake network. The issues were fixed through two recent hard forks called Austin and Kyoto. These updates were deployed privately and tested before being activated on the main network.

The vulnerabilities affected Polygon's Bor and Heimdall clients. They included denial-of-service risks, where attackers could flood the network with traffic, and validator resource exhaustion, which could overwhelm the computers securing the chain.

Key security fixes

• A severe flaw in Heimdall allowed specially crafted transactions to force validators to do excessive processing work.
• The Austin hard fork addressed two denial-of-service risks in Bor that could have slowed block processing or caused nodes to crash.
• No exploits were observed on the mainnet before the fixes were applied.

Upgrade requirements for nodes

Polygon said nodes running older versions of either client past the hard fork activation heights have already fallen out of consensus. This means they are no longer in sync with the rest of the network and must upgrade to rejoin.

Bor v2.10.0 is required for all Polygon PoS nodes, while Heimdall v0.11.0 is required for validators and full nodes. Both upgrades are now active on the mainnet.

POL price context

POL, Polygon's native token formerly known as MATIC, was trading around $0.10 at the time of the report. The token was down about 4% over the past week but up 44% over the past month and 2.3% year to date, according to CoinGecko data.

Source information

The disclosure came from Polygon Labs' Validators Support Team on Thursday. The primary source is a security release on the Polygon Technology forum.

• Polygon Technology Forum
• Cointelegraph