Nested protobuf fields let one cheap transaction force work on every Polygon validator

Polygon Labs quietly released two hard forks that fixed a number of security issues in its proof-of-stake (POS) network.

The layer-2 network finally shared the details in a forum post. All node operators have to upgrade or they will be kicked out of the network consensus.

Austin fork stops nodes from sending the TxDependency field

The worst bug was in Heimdall, which is the software that coordinates Polygon validators.

Heimdall bundles the contents of each transaction inside a wrapper called, google.protobuf.Any, according to a forum post by Parvez03.

A wrapper can sit inside another, just like how boxes can be packed inside other boxes. However, in this analogy, there’s no cap on how many layers deep wrappers could go.

An attacker could create a single transaction stacked with those layers for almost no cost. This makes validators waste computing power to unpack it.

Polygon described the flaw as “a permissionless way to force costly, correlated work across the whole validator set.”

The Kyoto hard fork upgraded the Heimdall software to v0.11.0.

“Kyoto adds a byte-level pre-scan that rejects a transaction once its nesting passes a threshold, enforced identically at mempool admission (CheckTx) and on the consensus path (ProcessProposal),” the post said.

Polygon checks two times:

• When a transaction arrives.
• When validators build the block.

The second hard fork, named Austin, focused on Bor, Polygon’s execution client. It patched two denial-of-service paths.

One was state-sync events, the process that carries L1-to-L2 bridge deposits. Those events execute contract code and precompiles, just like a normal transaction would do. However, the amount of gas burned was not capped per block.

The Austin fork adds a hard per-block limit on state-sync gas.

Polygon never capped the size of the TxDependency field.

A validator could load it with huge data to crash every node that read the block. There’s nothing else about that block that looked wrong.

Austin removes the field from the wire format entirely.

Kyoto fork activated at Heimdall height 51,533,000

Polygon said that nobody exploited the bugs on the mainnet and that it fixed them all before the forks went live.

The Austin fork was activated on mainnet at Bor block 91,949,700 and the Kyoto fork at Heimdall height 51,533,000.

Every node requires Bor v2.10.0. Validators and full nodes also require Heimdall version 0.11.0. Nodes running older software have already forked from the canonical chain.

The fixes are simple binary upgrades, with no state migration, genesis change, or full resyncs needed.

POL traded at $0.09, down about 9.3% over the past 24 hours. The token is in the green zone, up 25.8% over the last 30 days, according to CoinGecko.

In July, the Heimdall V2 mainnet went offline for about an hour, according to a past Cryptopolitan report.