Polygon disclosed that it had shipped two coordinated hardforks across its proof-of-stake clients to close denial-of-service vectors, publishing details only after both were already active on mainnet.
The post on Polygon’s community forum describes the sequence as standard practice for consensus-affecting fixes: rolled out privately, validated on the Amoy testnet, activated on mainnet, and made public once the fleet was safe.
What Austin Fixed
Austin, shipped as Bor v2.10.0, closes two paths in block processing. Bor is Polygon Chain’s execution layer, the component that processes transactions and produces blocks.
The first concerns state-sync events—the mechanism carrying deposits from Ethereum to Polygon. Those events execute contract code like ordinary transactions, but the gas they consumed was not metered against a hard cap. A block carrying enough state-sync events, or one sufficiently expensive event, could make block processing slow enough to transiently stall the chain. Austin adds a per-block bound.
The second is more direct. Bor carried a block field called TxDependency, used as a hint for parallel execution to indicate which transactions in a block do not conflict. It had no size limit. A block producer could include an arbitrarily large blob in that field in an otherwise valid sibling block, and any peer receiving it would crash trying to process it. Austin removes the field from the wire format entirely, which Polygon says leaves parallel execution unaffected because it never depended on trusting a producer’s hint.
Austin activated at block 44,120,000 on Amoy and 91,949,700 on mainnet.
What Kyoto Fixed
Kyoto, shipped as Heimdall v0.11.0, bundles consensus-hardening and input-validation fixes. Heimdall is the proof-of-stake consensus layer that submits checkpoints to Ethereum.
Polygon identifies the most severe item as a bound on nested google.protobuf.Any depth. Heimdall transactions wrap inner messages in Any types, which can nest inside one another. Without a cap, a single crafted transaction with deeply nested fields could force every validator to perform a large amount of decode work at once—cheap for the sender, expensive for the network. Polygon describes it as a permissionless way to force costly, correlated work across the whole validator set.
The fix adds a byte-level pre-scan enforced identically at mempool admission and on the consensus path, so a transaction cannot be admitted on one path and rejected on the other.
Kyoto also caps the number of fee coins a transaction can declare after an unbounded list previously fed an O(n) validation scan. It normalizes the recovery byte on checkpoint signatures, which could otherwise produce a validly signed checkpoint that fails signature recovery on Ethereum—stalling checkpoint anchoring without forging anything.
It makes producer-downtime handling idempotent, binds milestone range voting to the signed parent hash, adds a checkpoint-window continuity check, stops a failed future-span creation from blocking milestone commit, and fixes replay keys for out-of-range log indexes where two distinct Ethereum events could hash to the same key.
Kyoto activated at height 42,252,000 on Amoy and 51,533,000 on mainnet.
The hardforks follow a period of instability on the network. In September 2025 a consensus bug produced finality delays of up to 15 minutes, prompting an emergency hardfork that upgraded Bor to v2.2.11-beta2 and Heimdall to v0.3.1. The Giugliano hardfork in April 2026 targeted faster finality and embedded fee parameters into block headers. Heimdall’s version numbering has moved from v0.3.1 to v0.11.0 across that period.
What Operators Need to Do
Both upgrades are mandatory, and both are already active.
A node running an earlier version past the activation heights has already fallen out of consensus. Polygon says upgrading and rolling back to pre-hardfork heights lets it resync and rejoin. Neither release requires state migration, a genesis change, or a full resync.
What Polygon Says About Exploitation
Polygon states that neither Austin issue was observed causing disruption on the mainnet, and that both were addressed proactively ahead of any exploitation. It describes the Austin items as resource-exhaustion vectors rather than consensus-correctness issues and says all Kyoto items were resolved and validated before either hardfork activated.
It also says Kyoto-gated behavior is inert below the fork height, and the guards fire only on crafted inputs, leaving normal traffic unaffected.
The Crypto Times has contacted Polygon Labs to confirm the disclosure timeline, whether any of the issues were reported through a bug bounty, and whether Polygon Chain forks built with Polygon CDK share the affected code; this report will be updated with any response.
Also Read: Core Lightning Pushes Back on Shutdown Calls Ahead of Embargoed Security Fix
