Strengthening the Polygon Network: The Austin and Kyoto Hardforks

Polygon Labs has successfully implemented two critical security-focused hardforks, named Austin and Kyoto, to fortify the Polygon Proof-of-Stake (PoS) network. These upgrades were designed as proactive measures to address specific vulnerabilities within the network’s dual-client architecture, focusing on the execution client, Bor, and the consensus client, Heimdall. By introducing these fixes, Polygon aims to prevent potential resource-exhaustion attacks and ensure the seamless processing of transactions across its ecosystem.

Bor and the Austin Upgrade: Preventing Execution Bottlenecks

The Austin hardfork specifically targets Bor, Polygon’s execution client, to mitigate risks associated with block processing delays and peer instability. One primary fix involves capping the gas consumed during state-sync events—processes that handle deposits from the Ethereum L1 to the Polygon L2. Previously, these events did not count against a fixed block-level gas ceiling, creating a risk where a surge of events could stall the chain. Additionally, the upgrade addresses a vulnerability in the "TxDependency" field; by removing this previously unlimited data field, the network now prevents malicious producers from crashing peer nodes with arbitrarily large data blobs.

Heimdall and Kyoto: Securing Consensus and Network Stability

Simultaneously, the Kyoto hardfork was rolled out to upgrade Heimdall, the client responsible for consensus and checkpointing. This update addresses a high-severity risk involving deeply nested message decoding, which could have allowed a single transaction to force validators into excessive computational work. Beyond this, Kyoto introduces several refinements to network operations, such as normalizing checkpoint signature recovery to prevent stalls on Ethereum and capping fee-coin lists to streamline validation. These changes collectively ensure that validators remain synchronized and that the process of anchoring Polygon’s state to the Ethereum mainnet remains robust.

Critical Requirements for Node Operators

For node operators, these hardforks represent a mandatory transition to maintain canonical consensus. Any Polygon PoS node still running on outdated binaries—specifically Bor versions earlier than v2.10.0 or Heimdall versions earlier than v0.11.0—has already fallen out of sync with the network's accepted history. While the upgrades do not require state migration or a genesis change, operators who missed the activation heights in August must now update their software and potentially roll back to a pre-hardfork point to catch up with the current state of the blockchain.