Polygon Reveals Patched Security Flaws After Two Private Hard Forks

Security Vulnerabilities Publicly Disclosed

Polygon Labs' Validators Support Team released a disclosure on Thursday detailing several previously private security weaknesses that had affected the Polygon proof-of-stake network. The issues, which had already been remediated, touched both the Bor and Heimdall client software and carried risks ranging from denial-of-service attacks to validator resource exhaustion and defects in checkpoint and milestone processing.

The team confirmed that the vulnerabilities were resolved through two hard forks — Austin and Kyoto — which were deployed in a private capacity, subjected to testing, and only activated on mainnet after the fixes were verified. Only after this process was complete did Polygon make the details public.

Nature and Severity of the Flaws

The most serious vulnerability was identified in Heimdall, where a specially constructed transaction could compel validators to perform an outsized amount of processing work, potentially destabilizing the broader network. Separately, the Austin hard fork remediated two distinct denial-of-service vectors within Bor that, if exploited, could have degraded block-processing speed or triggered node crashes.

Polygon emphasized that none of the disclosed vulnerabilities had been observed in active exploitation on mainnet. The company stressed that the patches were rolled out proactively, well before any public communication, limiting the window of exposure to near zero.

Required Upgrades for Network Participants

The disclosure also carried a practical warning for operators: any node still running an older version of Bor or Heimdall beyond the respective hard fork activation heights has already lost consensus and will need to upgrade in order to rejoin the canonical network. All Polygon PoS nodes are now required to run Bor version 2.10.0, while validators and full nodes must be on Heimdall version 0.11.0. Both upgrades are already live on mainnet.

POL Token Performance

At the time of writing, POL — Polygon's native token, previously known as MATIC — was trading in the vicinity of $0.10. According to CoinGecko data, the asset had slipped roughly 4 percent over the trailing seven-day period but remained up approximately 44 percent on a monthly basis and 2.3 percent year to date.