Polygon discloses security flaws fixed in recent hard forks

cointelegraph2026-08-29 tarihinde yayınlandı2026-08-29 tarihinde güncellendi

Özet

Polygon has revealed previously undisclosed security vulnerabilities in its proof-of-stake network, which were fixed via the recent Austin and Kyoto hard forks. The flaws, affecting the Bor and Heimdall clients, included denial-of-service risks, validator resource exhaustion, and issues with checkpoint processing. The most severe involved a Heimdall vulnerability where a malicious transaction could overload validators and disrupt the network. Polygon stated the fixes were deployed privately and tested before mainnet activation, with no observed exploits. Nodes must upgrade to Bor v2.10.0 and Heimdall v0.11.0 to remain in consensus.

Polygon has disclosed several previously private security vulnerabilities that could have disrupted its proof-of-stake network, after deploying fixes through two recent hard forks.

The vulnerabilities affected Polygon’s Bor and Heimdall clients and included denial-of-service risks, validator resource exhaustion and flaws affecting checkpoint and milestone processing, according to a Thursday disclosure from Polygon Labs’ Validators Support Team.

Polygon said the flaws were fixed through the Austin and Kyoto hard forks, which were deployed privately and tested before being activated on mainnet and publicly disclosed.

The most severe issue involved Heimdall, where a specially crafted transaction could force validators to perform excessive processing work, potentially disrupting the network. The Austin hard fork separately addressed two denial-of-service risks in Bor that could have slowed block processing or caused nodes to crash.

None of the vulnerabilities were observed being exploited on mainnet, according to Polygon, which said the fixes were deployed proactively before details were made public.

Nodes running older versions of either client past the hard fork activation heights have already fallen out of consensus and must upgrade to rejoin the canonical network, according to the disclosure. Bor v2.10.0 is required for all Polygon PoS nodes, while Heimdall v0.11.0 is required for validators and full nodes, with both upgrades already active on mainnet.

POL, Polygon’s native token formerly known as MATIC, was trading around $0.10 at the time of writing, down about 4% over the past week but up 44% over the past month and 2.3% year to date, according to CoinGecko data.

Magazine: SHRINCS BIP published: Quantum-secure Bitcoin comes with a catch

İlgili Sorular

QWhat were the general security vulnerabilities disclosed by Polygon in their proof-of-stake network?

APolygon disclosed vulnerabilities that included denial-of-service risks, validator resource exhaustion, and flaws affecting checkpoint and milestone processing in their Bor and Heimdall clients.

QHow did Polygon fix the disclosed security vulnerabilities?

APolygon fixed the vulnerabilities through two recent hard forks named Austin and Kyoto, which were deployed privately, tested, and then activated on the mainnet before being publicly disclosed.

QWhat was the most severe security issue mentioned in the article?

AThe most severe issue was in the Heimdall client, where a specially crafted transaction could force validators to perform excessive processing work, potentially disrupting the network.

QWhat versions of the clients are now required for nodes following the hard forks?

ABor v2.10.0 is required for all Polygon PoS nodes, and Heimdall v0.11.0 is required for validators and full nodes.

QWere any of the disclosed vulnerabilities exploited on the Polygon mainnet?

ANo, according to Polygon, none of the vulnerabilities were observed being exploited on the mainnet.

İlgili Okumalar

Ripple Donates $300,000 to Aid Flood Victims in Nepal and Tibet

Ripple has donated $300,000 to provide emergency food, water, and sanitation aid following devastating floods in Nepal and Tibet. The funds will be distributed through non-profit partners World Central Kitchen and Mercy Corps to support immediate relief efforts. The floods, triggered by a glacial avalanche, have severely impacted districts in Nepal and the Gyirong border port in Tibet, destroying homes, roads, bridges, and critical infrastructure. UNICEF reports at least 17,000 children affected in Nepal, with significant damage to schools. This donation builds upon Ripple's existing humanitarian partnerships. Both organizations have previously tested Ripple's payment solutions and its stablecoin, $RLUSD, to explore faster and more transparent methods for distributing emergency aid. Ripple's contribution aims to address the urgent needs in the affected regions.

cryptonews.ru1 saat önce

Ripple Donates $300,000 to Aid Flood Victims in Nepal and Tibet

cryptonews.ru1 saat önce

Prominent Economist Sharply Criticizes Recent Fed Policy: 'They Are Moving in the Wrong Direction'

Economist James E. Thorn sharply criticizes the recent monetary policy of the Federal Reserve, arguing it is moving in the wrong direction. He contends that current high inflation is driven significantly by supply-side factors like energy costs, housing shortages, and production constraints, rather than solely by overheated demand. Thorn believes further interest rate hikes may not address these root causes and could instead weaken the economy's productive capacity by hindering critical investments in areas like AI, data centers, and infrastructure. He points to declining full-time employment data and pressure in the interest-rate-sensitive housing sector as signs of structural economic transformation, not overheating. Thorn argues these trends reflect adaptation to changing fiscal policy and industrial conditions. He also differentiates between one-time price shocks from factors like tariffs or oil prices and a sustained inflationary spiral, suggesting the Fed's policy response may be misaligned. Thorn concludes that additional tightening could represent a deliberate suppression of demand based on a misdiagnosis, potentially stifling the economy's long-term investment and production capacity expansion.

cryptonews.ru1 saat önce

Prominent Economist Sharply Criticizes Recent Fed Policy: 'They Are Moving in the Wrong Direction'

cryptonews.ru1 saat önce

Don't Trust, Verify: Malicious AI Links Expose a Nightmare Reality for Crypto Industry Workers

Generative AI is becoming increasingly prevalent, with professionals in the digital assets and blockchain space regularly using it. However, this makes them prime targets for attackers seeking to steal sensitive, often irrevocable, information. Refi Hub co-founder Numa Lunah recently reported being "hacked" through a malicious link sent in a chat with the AI model Claude, which appeared to be a legitimate transcription app download. The link installed malware that attempted to steal all his data. While Numa claimed no sensitive data was leaked—as he wiped and reinstalled his laptop's OS—he later discovered a corrupted `SKILL.md` file in his backups, disguised as a style guide. This file contained hidden instructions to reload the malware and steal credentials whenever the AI accessed it. This incident highlights a new attack vector: LLMs providing malicious outputs. Microsoft Defender experts have previously warned about the evolution of cryptojacking attacks from SEO poisoning to "poisoning" LLM responses from models like Gemini, Claude, Copilot, and ChatGPT. Threats include malicious artifacts via context windows, chatbot-recommended download links, fake AI-branded installers, and infected source code or agent skills. For crypto professionals, the risk is heightened because they often manage irreplaceable secrets like seed phrases, private keys, exchange API keys, and wallet data. The article argues that the most dangerous vulnerability is human trust and complacency. A fundamental shift in security culture is needed: treating every AI suggestion as potentially hostile, regardless of its source. This isn't paranoia but a survival necessity. The key takeaway is that the threat lies not in vulnerable code but in the human instinct to trust convenient answers, a flaw no software patch can fix. Numa was saved only because he meticulously reviewed every configuration file before letting the AI interact with it—a level of caution most users likely neglect.

cryptonews.ru1 saat önce

Don't Trust, Verify: Malicious AI Links Expose a Nightmare Reality for Crypto Industry Workers

cryptonews.ru1 saat önce

Grayscale Named Three Cryptocurrencies That Could Benefit from Rising U.S. National Debt

Grayscale research suggests that the rapid growth of U.S. national debt, which recently surpassed $40 trillion, could drive investor demand for alternative stores of value like Bitcoin (BTC), Ethereum (ETH), and Zcash (ZEC). The firm's head of research, Zach Pandl, argues that "unchecked government debt expansion erodes trust in fiat currencies," potentially benefiting these specific cryptocurrencies in a "debasement trade." Bitcoin's primary appeal is its programmed scarcity with a 21 million coin cap. Ethereum offers a decentralized settlement network, while Zcash provides enhanced privacy features on a Bitcoin-like architecture. However, Bitcoin's role as a reliable store of value is still debated due to its volatility and other risks. The analysis follows the U.S. Treasury's announcement to expand its bond buyback program, a move seen as a response to market pressures rather than a solution to structural budget deficits. With the Congressional Budget Office forecasting rising deficits and debt-to-GDP ratios, Grayscale posits that persistent borrowing, coupled with private sector competition for capital (e.g., for AI infrastructure), could pressure interest rates higher and further incentivize the search for non-traditional assets.

cryptonews.ru1 saat önce

Grayscale Named Three Cryptocurrencies That Could Benefit from Rising U.S. National Debt

cryptonews.ru1 saat önce

Will the Fed Raise Interest Rates in September? Latest Probability Indicators Here!

Will the Fed raise interest rates in September? Market expectations have shifted significantly following cautious inflation remarks from Fed Chairman Kevin Warsh. The probability of a September rate hike has surged, with market-implied odds now around 55-56% for an increase, a sharp rise of about 20 basis points in a single day. The likelihood of rates remaining unchanged is approximately 55%, while a 25-basis-point hike is priced at about 46%. Chairman Warsh, speaking at the Jackson Hole symposium, acknowledged some positive summer inflation data but stated it does not indicate a substantial improvement in underlying inflation trends. He emphasized the need for clear and timely progress toward the Fed's inflation target, warning that further policy tightening may be necessary. Following his comments, U.S. Treasury yields rose sharply. The yield on the two-year note, highly sensitive to Fed policy expectations, increased about 8 basis points to 4.31%, reaching its highest level since late July. This surge reflects investor expectations of potential near-term monetary tightening. Key inflation and employment data due in the weeks leading up to the September 16th meeting are seen as crucial for final rate decision expectations. Persistently high inflation could increase the odds of a hike, while a significant slowdown in price pressures might bolster the case for holding rates steady.

cryptonews.ru3 saat önce

Will the Fed Raise Interest Rates in September? Latest Probability Indicators Here!

cryptonews.ru3 saat önce

İşlemler

Spot