Polygon Labs has issued an urgent notice requiring all Polygon PoS node operators to upgrade their Bor and Heimdall clients following the activation of the Austin and Kyoto hard forks.
The company disclosed that several previously unreported security vulnerabilities have been patched through these coordinated upgrades, stressing that nodes still running pre-fork software have already deviated from canonical consensus and must catch up to rejoin the network’s accepted history.
Austin activated on the mainnet at block 91,949,700 and requires Bor version 2.10.0 or later, while Kyoto activated at block height 51,533,000 and requires Heimdall version 0.11.0. The Kyoto mainnet fork went live on 18 August 2026 at 10:10:31 UTC, with both hard forks already active on the Amoy testnet at earlier block heights. Polygon emphasized that these are plain binary upgrades requiring no state migration or genesis changes.
However, operators who passed the activation thresholds on outdated clients have fallen out of consensus and must install the applicable release, roll back to a pre-hardfork point if necessary, and resync under official guidance to follow the canonical chain again.
The disclosed vulnerabilities affected Polygon’s execution and consensus layers separately. The Austin hard fork on Bor addressed two denial-of-service vectors in block processing: an unbounded gas consumption path during state-sync events from L1-to-L2 bridge deposits, and an unrestricted TxDependency extra-data field that could crash peers processing oversized blocks.
Since state-sync events execute contract code without a fixed block-level ceiling, sufficiently costly events could slow processing enough to transiently stall the chain. Austin resolved this by imposing a per-block gas limit on state-sync operations and removing the unbounded TxDependency field from the wire format entirely.
Kyoto introduced consensus-hardening measures across Heimdall’s transaction and checkpointing logic. The most severe fix limits the nesting depth of google.protobuf.Any messages, preventing malicious actors from constructing cheap transactions that force validators into expensive decode work.
Additional patches cap fee-coin counts before validation scans, normalize checkpoint signature recovery bytes to prevent anchoring failures on Ethereum, and harden milestone voting, producer-downtime handling, and L1-event replay key uniqueness. Polygon confirmed that none of the vulnerabilities were exploited on mainnet, and the fixes were privately validated on Amoy before public deployment to ensure fleet safety.
All node operators must treat the upgrades as mandatory. Bor serves as Polygon PoS’s execution client, while Heimdall manages consensus and checkpointing; maintaining current versions on both is essential for network compatibility and continued participation.
The post Polygon Discloses Unreported PoS Vulnerabilities Patched Via Austin And Kyoto Hard Forks, Mandates Client Updates appeared first on Metaverse Post.
