Polygon deployed two coordinated hard forks, Austin on Bor v2.10.0 and Kyoto on Heimdall v0.11.0, to close denial-of-service, resource-exhaustion and consensus-hardening vulnerabilities across its Polygon PoS client stack. The forks were privately deployed, validated on the Amoy testnet, and activated on both Amoy and mainnet before the public disclosure on August 27, with no mainnet disruption observed. Austin closed two Bor block-processing DoS paths by adding a per-block gas bound for state-sync events and removing the unbounded TxDependency wire field, while Kyoto targeted deeply nested protobuf fields in Heimdall transactions through byte-level pre-scanning. Bor v2.10.0 is mandatory for all nodes and Heimdall v0.11.0 is mandatory for all validators and full nodes, with activation blocks at 91,949,700 and 51,533,000 on mainnet respectively. The vulnerabilities were resource-exhaustion and consensus-edge-case risks, not correctness failures, resolved before any exploitation was observed on mainnet.
Source: Read the original article
