Crypto: Why Polygon Says the Austin and Kyoto Hard Forks Were Necessary

Polygon has finally explained what its Austin and Kyoto hard forks were hiding. The two updates fixed several security vulnerabilities kept private during their deployment. Some could slow down the network, crash nodes, or force validators to perform very costly computational work. Polygon claims no exploitation was observed on the mainnet.

Crypto: Austin closed two vulnerabilities in Bor

Polygon is already familiar with security hard forks. In 2025, the network had to fix a critical bug with an emergency update. This time, Austin focused on Bor, the client responsible in particular for producing Polygon PoS blocks.

The first vulnerability concerned state sync operations from Ethereum to Polygon. These operations can execute code and consume gas. Unlike traditional crypto transactions, no strict limit capped their total consumption in a block.

A sufficiently loaded block could therefore demand too much work from nodes. Polygon added a limit. The second weakness came from a field called TxDependency. It was used to aid the parallel execution of transactions, but its size was unbounded.

A block producer could theoretically create a huge field. Another node received the block. Then it could crash trying to process it. Austin simply removed this field from the format transmitted between nodes.

Kyoto mainly protected Heimdall

Kyoto concerned Heimdall, the other major component of the Polygon PoS network. Polygon had already deeply modernized this component with Heimdall v2, presented as its most complex hard fork since 2020.

The most important vulnerability came from specially crafted crypto transactions. Heimdall uses structures capable of containing others. Without depth limits, an attacker could stack these elements and send a relatively simple transaction to create.

Validators then had to do a lot of calculations to decode it. The same work. On almost all validators. Kyoto now enforces a maximum depth and rejects transactions that exceed this threshold.

The update also fixes a fee list that could previously become extremely long. Again, the goal was to prevent a user from causing unnecessary resource consumption.

Other fixes affect checkpoints, milestones, and some events from Ethereum. A valid checkpoint signature could notably arrive in a form that later failed when processed on Ethereum. No need to steal tokens to disrupt a network. Wasting crypto validators’ time can already suffice.

Polygon fixed issues before talking about them

Polygon did not publish the details immediately. Austin and Kyoto were first quietly deployed, tested on Amoy, then activated on the mainnet. The explanations came afterwards.

This is intentional. Publishing a vulnerability before validators had the fix would have also given instructions to attackers. Austin now requires Bor v2.10.0. Kyoto requires Heimdall v0.11.0 for validators and full nodes.

Polygon ensures that none of the disclosed vulnerabilities caused any known incidents on the mainnet. The fixes were thus preventive. The network has accelerated its updates significantly over the past two years. At the end of 2025, Polygon had also deployed Madhugiri to reduce consensus time and increase performance. Austin and Kyoto tell another part of the story. No more speed this time. Simply doors that were better closed before someone tried to open them.Operators remaining on an old version after activation heights no longer follow the canonical chain. They must update their software and then resynchronize.

Evans S.

Fascinated by Bitcoin since 2017, Evariste has continuously researched the subject. While his initial interest was in trading, he now actively seeks to understand all advances centered on cryptocurrencies. As an editor, he strives to consistently deliver high-quality work that reflects the state of the sector as a whole.

DISCLAIMER

The views, thoughts, and opinions expressed in this article belong solely to the author, and should not be taken as investment advice. Do your own research before taking any investment decisions.