Overview
- Polygon rolled out two hard forks privately and validated them on the Amoy testnet before activating them on mainnet to fix multiple consensus-affecting vulnerabilities.
- The Bor upgrade (Austin, Bor v2.10.0) blocks two block-processing denial-of-service paths, including a crash risk from an oversized TxDependency data field.
- The Heimdall upgrade (Kyoto, Heimdall v0.11.0) adds input-validation that stops transactions with deeply nested google.protobuf.Any fields from forcing expensive, coordinated decoding across the validator set.
- Both changes were delivered as binary upgrades that need no state migration or full resync, but nodes that missed the activation heights have fallen out of consensus until they update their software.
- Polygon says it found no evidence of mainnet exploitation and frames the work as proactive hardening as the network completes other upgrades such as the MATIC-to-POL migration and prior performance changes.