Polygon has disclosed several security vulnerabilities that were fixed in recent hard forks, revealing that its proof-of-stake network faced denial-of-service threats and validator resource risks before the patches were applied. The announcement came from Polygon Labs’ Validators Support Team, which said the flaws affected the two main pieces of Polygon PoS infrastructure — Bor and Heimdall. Although the conditions were potentially serious, no exploit was observed on mainnet. Details were withheld until the Austin and Kyoto hard forks had been activated.
One of the most significant findings is that the vulnerabilities were already patched by the time they were made public. In blockchain, publicly explaining a bug before node operators can upgrade can be dangerous, because attackers can use those details to attack networks that have not updated. Polygon chose to coordinate private upgrades, run tests, and only reveal the vulnerabilities after the fixes were live on Polygon’s mainnet. This approach reduced the window of opportunity for attackers.
Understanding Bor and Heimdall
Polygon PoS is not a single-piece blockchain client. It is a system of two cooperating layers. Bor is the EVM-compatible sidechain layer that creates and processes blocks containing transactions, smart contracts, and decentralized application interactions. Heimdall is the validator and consensus layer, functioning as the control plane that coordinates validators, validates headers, and creates the checkpoints that are periodically submitted to Ethereum.
When a user sends a transaction through Polygon PoS, the transaction first gets included in a Bor block. Those blocks are then anchored to the main Ethereum chain by Heimdall, providing finality and protection against chain reorganization. Validators need to run key functions in both clients. Because Bor is exposed to user-generated transactions, attackers often look for malformed inputs that can force nodes to do more work than expected.
Heimdall is often a more sensitive target. If a vulnerability exists in Heimdall’s transaction processing, a single crafted transaction could obstruct the ability of validators to sign proposals or submit checkpoints. Since Heimdall is positioned between Polygon and Ethereum, successful attacks against it might have consequences for the entire PoS ecosystem rather than just a single decentralized application.
The security flaws covered in the disclosure
According to Polygon, the class of vulnerabilities included denial-of-service risks, validator resource exhaustion, and issues affecting checkpoint and milestone processing. These are not necessarily flaws that would allow an attacker to steal funds. Instead, they could be used to degrade the reliability of a blockchain, slow down block production, panic validators, or cause node crashes. For a proof-of-stake network whose value depends on real-time availability, such attacks can be widespread and hard to mitigate quickly.
The most severe issue was found in Heimdall, where a specially crafted transaction could force validators to perform an excessive amount of processing work. In a proof-of-stake environment, validators are expected to stay online and process messages within a specific block time. If an attacker can make the processing cost much higher than expected, validators may fall behind. This could lead to missed blocks, postponed checkpoints, disagreement about the latest state, or even brief consensus interruption.
The Austin hard fork separately addressed two denial-of-service vulnerabilities in Bor. One of the flaws could slow block processing while the other could cause nodes to crash. A Bor-focused denial-of-service attack can be especially disruptive because Bor handles the bulk of ordinary transactions and is the point at which users interact with applications. If a malicious transaction forced Bor nodes into a lengthy computation, the chain could experience high latency and poor user experience. A crash-based bug could take a significant share of nodes offline, causing temporary distribution problems or network stalling.
Checkpoints and milestones in focus
The mention of checkpoint and milestone processing in the vulnerability disclosure points to one of Polygon’s distinctive security mechanisms. Polygon PoS periodically submits checkpoint transactions to Ethereum. These checkpoints are created and signed by validators on Heimdall, and they help anchor Polygon’s sidechain to Ethereum’s mainnet
Source: Cointelegraph News