{"id":50156,"date":"2026-08-31T19:30:39","date_gmt":"2026-08-31T19:30:39","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=50156"},"modified":"2026-08-31T19:30:39","modified_gmt":"2026-08-31T19:30:39","slug":"polygon-shipped-two-hard-forks-before-telling-anyone-what-they-fixed","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=50156","title":{"rendered":"Polygon shipped two hard forks before telling anyone what they fixed"},"content":{"rendered":"

Polygon Labs quietly released two hard forks that fixed a number of security issues in its proof-of-stake (POS) network.<\/strong><\/p>\n

The layer-2 network finally shared the details in a forum post. All node operators have to upgrade or they will be kicked out of the network consensus.<\/p>\n

Austin fork stops nodes from sending the TxDependency field<\/span><\/h3>\n

The worst bug was in Heimdall, which is the software that coordinates Polygon validators.<\/p>\n

Heimdall bundles the contents of each transaction inside a wrapper called, google.protobuf.Any<\/code>, according to a forum post<\/a> by Parvez03.<\/p>\n

A wrapper can sit inside another, just like how boxes can be packed inside other boxes. However, in this analogy, there\u2019s no cap on how many layers deep wrappers could go.<\/p>\n

An attacker could create a single transaction stacked with those layers for almost no cost. This makes validators waste computing power to unpack it.<\/p>\n

Polygon described the flaw as \u201ca permissionless way to force costly, correlated work across the whole validator set.\u201d<\/p>\n

The Kyoto hard fork upgraded the Heimdall software to v0.11.0.<\/p>\n

\n

\u201cKyoto adds a byte-level pre-scan that rejects a transaction once its nesting passes a threshold, enforced identically at mempool admission (CheckTx<\/code>) and on the consensus path (ProcessProposal<\/code>),\u201d the post<\/a> said.<\/p>\n<\/blockquote>\n

Polygon checks two times:<\/p>\n