Polygon discloses fixes for validator disruption risks

Polygon published a security review of the Austin and Kyoto hard forks, both already active on its proof-of-stake mainnet. The coordinated upgrades changed the Bor and Heimdall clients to close ways of overloading block processing and harden consensus-related validation.

Austin places a gas bound on state-sync processing and removes an unbounded block field that could crash peers. Kyoto limits deeply nested transaction messages and excessive fee-coin lists, alongside fixes to checkpoint handling, milestone votes and event replay protection.

Polygon said the Bor issues had not been observed disrupting mainnet. The changes were deployed privately, tested on Amoy and disclosed after operators had upgraded. Nodes remaining below the required versions after activation would no longer follow the canonical chain.

The disclosure shows how small input-validation gaps can become network-wide availability problems when every validator must process the same hostile data.