Polygon patches validator flaws in 2 hard forks as POL slips 2.3%

Polygon Labs patched security flaws across its PoS network via two hard forks, including a flaw that could force the full validator set to process one crafted transaction.

Polygon's Validators Support Team disclosed the fixes in an Aug. 27 forum post, saying consensus-affecting security updates were deployed privately, validated on the Amoy testnet and disclosed only after the mainnet fleet was protected.

The Austin hard fork upgraded Bor to version 2.10.0 and addressed two denial-of-service paths tied to block processing. One involved state-sync events used for Ethereum L1-to-L2 bridge deposits, which could execute contract code and precompiles without an effective per-block gas bound. A separate weakness involved TxDependency data, where a malicious block producer could supply an oversized data field, potentially causing excessive memory allocation and crashing peers.

Both hard forks are mandatory for operators that want to remain on the canonical Polygon PoS network. Bor v2.10.0 is required for all nodes, while Heimdall v0.11.0 applies to validators and full nodes. Operators running versions from before the activation heights have already forked away from canonical consensus and must update their software to rejoin the network.

The Kyoto hard fork, which moved Heimdall to version 0.11.0, covered a larger group of input-validation and consensus-hardening fixes. Polygon identified deeply nested google.protobuf.Any fields as the most severe vulnerability in the batch. Heimdall transactions can wrap messages inside Any fields, which in turn can be nested inside one another. Without a depth limit, an attacker could construct a transaction containing deeply nested fields at relatively little cost while forcing every validator processing it to carry out substantial decoding work.

Kyoto added a byte-level scan that rejects transactions once nesting exceeds a defined threshold. The check applies at both mempool admission and the consensus processing stage so the same transaction cannot be accepted through one path and rejected through another.

Other Heimdall fixes covered milestone accounting, checkpoint processing and L1 event replay. Failed future-span creation can now degrade and retry at the next boundary instead of blocking a milestone commit, while new replay keys address an edge case in which distinct L1 events could otherwise collide.

Polygon said it found no evidence that any of the issues had been exploited or caused disruption on mainnet. The changes were delivered as binary upgrades, meaning operators do not need to migrate state, modify the genesis configuration or perform a full resync.

A history of hard-fork fixes

Polygon has previously used hard forks to address problems affecting its PoS infrastructure. In September 2025, developers executed a hard fork after a software bug caused transaction finality delays of as much as 15 minutes. A month later, the Rio mainnet upgrade introduced witness-based stateless validation and a Validator-Elected Block Producer model.

Network performance remained another focus in 2026. In May, Polygon reduced block time to an average of 1.75 seconds, its first block-time reduction since launch. Polygon software engineer Lucca Martins said at the time that the change raised theoretical throughput to roughly 3,260 transactions per second.

The latest security fixes arrived after Polygon completed the replacement of MATIC with POL as the native gas and staking token on its PoS network. The migration began in September 2024 as part of the Polygon 2.0 roadmap.

POL shows muted reaction

POL showed little positive reaction to the security disclosure. The token was trading near $0.09983 on Aug. 30, down about 2.3 percent over the previous 24 hours and 6.8 percent over seven days, according to CoinGecko data. Its price remained about 60.8 percent lower than a year earlier, giving the token a market capitalization of roughly $1.07 billion.

Changes have extended to Polygon Labs itself. In July, the company cut another round of jobs while completing the integration of crypto exchange Coinme. CEO Marc Boiron said the restructuring was designed to support profitability by 2027 as Polygon Labs moved toward a payments-focused business model.

This article is for informational purposes only and does not constitute investment advice.