Polygon Labs disclosed Wednesday that it had quietly patched a batch of security vulnerabilities through two hard forks, Austin and Kyoto, deployed on its Bor and Heimdall clients. The announcement came after the fixes were already live.
The disclosures appeared in a Polygon forum post detailing what the team called standard practice for consensus-affecting fixes: patch first, disclose later. Node operators upgraded before they knew precisely why.
Austin targeted the Bor client. Two denial-of-service paths in block processing, both closed. The most concrete threat: a malicious block producer could crash peer nodes by stuffing a block with an oversized data field. A single actor running a validator could knock neighboring nodes offline with one crafted block. Peers never got the chance to reject it in time.
Kyoto went after a larger set of consensus-hardening issues in the Heimdall client. The most severe vulnerability would have let an attacker force costly, coordinated work across the entire validator set using a single crafted transaction. Cheap to build, expensive for the network to process. Polygon did not quantify the cost.
Both upgrades are mandatory now. Already active on mainnet. No state migration or resync required, which keeps the operational disruption to a simple client version bump. Validators who had not updated by activation would simply fall out of consensus with the rest of the network.
Polygon stated that none of the flaws were observed being exploited on mainnet. All were resolved proactively. The company did not name any third-party auditors or bug-bounty researchers in the disclosure. Nor did it specify who reported the vulnerabilities.
The gap between deployment and disclosure is the crux of this story. Consensus-affecting fixes carry a timing trade-off that Polygon framed as standard practice: disclose early and risk copycat attacks before the network upgrades, or deploy quietly and validators run code whose purpose they cannot fully vet until after the fact. Polygon chose the latter path. It validated the patches on its Amoy testnet before mainnet activation, then published the technical details once the network was safe.
What stands out is the scale. Two separate clients. Two coordinated forks. A combined disclosure that covers both the block-processing layer and the validator coordination layer in one pass.
The security work lands amid a broader architecture overhaul. The network is mid-migration from its legacy MATIC token to POL, a change tied to Polygon’s shift toward zero-knowledge-proof-based scaling.
POL traded near $0.09983 on Sunday, according to CoinGecko data cited by Decrypt. Down 2.3% over 24 hours, roughly 6.8% over the past week, and about 60.8% over the past year. Market capitalization sits near $1.07 billion. The price movement does not appear tied to the security disclosure, which landed without market disruption.
What remains unknown is how long the gap between mainnet activation and Wednesday’s forum post actually ran. Polygon did not publish those dates. Nor did it say whether any independent security firms reviewed the patches before deployment.
