Crypto: Why Polygon Says the Austin and Kyoto Hard Forks Were Necessary

Polygon has finally explained what its Austin and Kyoto hard forks were hiding. The two updates fixed several security vulnerabilities kept private during their deployment. Some could slow down the network, crash nodes, or force validators to perform very costly computational work. Polygon claims no exploitation was observed on the mainnet.

In Brief

• Austin fixed two denial-of-service risks in Bor.
• Kyoto strengthened Heimdall against multiple attacks and validation errors.
• The fixes had already been activated before their public disclosure.

Crypto: Austin closed two vulnerabilities in Bor

Polygon is already familiar with security hard forks. In 2025, the network had to fix a critical bug with an emergency update. This time, Austin focused on Bor, the client responsible in particular for producing Polygon PoS blocks.

The first vulnerability concerned state sync operations from Ethereum to Polygon. These operations can execute code and consume gas. Unlike traditional crypto transactions, no strict limit capped their total consumption in a block.

A sufficiently loaded block could therefore demand too much work from nodes. Polygon added a limit. The second weakness came from a field called TxDependency. It was used to aid the parallel execution of transactions, but its size was unbounded.

A block producer could theoretically create a huge field. Another node received the block. Then it could crash trying to process it. Austin simply removed this field from the format transmitted between nodes.

Kyoto mainly protected Heimdall

Kyoto concerned Heimdall, the other major component of the Polygon PoS network. Polygon had already deeply modernized this component with Heimdall v2, presented as its most complex hard fork since 2020.

The most important vulnerability came from specially crafted crypto transactions. Heimdall uses structures capable of containing others. Without depth limits, an attacker could stack these elements and send a relatively simple transaction to create.

Validators then had to do a lot of calculations to decode it. The same work. On almost all validators. Kyoto now enforces a maximum depth and rejects transactions that exceed this threshold.

The update also fixes a fee list that could previously become extremely long. Again, the goal was to prevent a user from causing unnecessary resource consumption.

Other fixes affect checkpoints, milestones, and some events from Ethereum. A valid checkpoint signature could notably arrive in a form that later failed when processed on Ethereum. No need to steal tokens to disrupt a network. Wasting crypto validators’ time can already suffice.

Polygon fixed issues before talking about them

Polygon did not publish the details immediately. Austin and Kyoto were first quietly deployed, tested on Amoy, then activated on the mainnet. The explanations came afterwards.

This is intentional. Publishing a vulnerability before validators had the fix would have also given instructions to attackers. Austin now requires Bor v2.10.0. Kyoto requires Heimdall v0.11.0 for validators and full nodes.

Polygon ensures that none of the disclosed vulnerabilities caused any known incidents on the mainnet. The fixes were thus preventive. The network has accelerated its updates significantly over the past two years. At the end of 2025, Polygon had also deployed Madhugiri to reduce consensus time and increase performance. Austin and Kyoto tell another part of the story. No more speed this time. Simply doors that were better closed before someone tried to open them.Operators remaining on an old version after activation heights no longer follow the canonical chain. They must update their software and then resynchronize.