Still running a Polygon PoS node on a Bor or Heimdall binary that predates August? Your node has already dropped off the canonical chain. This isn’t a warning about what might happen. It has happened.
That’s the unvarnished takeaway from Polygon Labs’ advisory, and it deserves a moment’s attention, because both activation heights are now behind us. On mainnet, Austin took effect at block 91,949,700. Kyoto switched on at Heimdall height 51,533,000 — a moment Polygon’s own release notice stamps as Aug. 18, 10:10:31 UTC. Skip either fork and a simple restart won’t save you. The sequence is: upgrade, sync back up, and only after that are you tracking the history the network actually accepts.
What broke, and what it would have looked like
One point Polygon’s Aug. 27 security review is precise about: no mainnet disruption was observed from Austin, and the disclosed changes are presented as proactive fixes. Fair enough. Still, the failure modes are concrete enough that skimming them does you a disservice.
Austin addressed two distinct resource-exhaustion issues, and each fails in its own direction.
The first concerns state-sync events generated by L1-to-L2 bridge deposits. As Bor handles them, they run contract code and precompiles — and that consumes gas, same as anything else. What was missing was any accounting of that gas against a fixed per-block ceiling. Pack enough events into a single block, or include one sufficiently costly event, and block processing drags badly enough to stall the chain temporarily. Austin puts a cap on that gas.
The second is the quieter but meaner of the pair. Bor’s TxDependency extra-data field exists as a parallel-execution hint provided by the block producer, and nothing constrained its size. That let a producer pack an arbitrarily large blob into an otherwise valid sibling block, crashing any peer that attempted to process it. Austin strips the field out of the wire format altogether.
So: one route stalls your blocks, the other takes down your peers. Polygon labeled both as resource-exhaustion risks.
Kyoto’s worst bug was a cheap transaction that cost everyone else
Kyoto’s highest-severity fix concerns deeply nested google.protobuf.Any messages. The asymmetry is what makes it dangerous: for very little cost, a sender could craft one transaction that forced every validator into heavy decoding work. Cheap for the sender, expensive for the whole validator set.
To close it, the hardfork introduces a byte-level nesting check at two points — mempool admission and block-proposal processing — so both routes behave identically. That symmetry is more important than it appears. Checking one path but not the other is precisely how you wind up with transactions the mempool refuses but a proposed block carries through unchallenged.
Kyoto additionally caps fee-coin lists before an O(n) validation scan iterates over them. Since Heimdall’s integration allows only a single fee coin regardless, the cap has no practical cost.
The rest of Kyoto is edge-case cleanup, and it’s the interesting part
What’s left reads like an inventory compiled by someone who spent a long time staring at anchoring and milestone logic.
Checkpoint signature recovery bytes are now normalized, closing off the case where a valid signature fails recovery on Ethereum and anchoring grinds to a halt. Repeated producer-downtime messages are now idempotent. Votes on milestone ranges are tied to the signed parent hash. And a future-span creation that fails no longer holds up milestone commitment.
Then comes the replay-key change — the one worth flagging if bridge correctness is on your mind. Replay keys covering topup, clerk and stake events were made injective for out-of-range log indexes, which prevents distinct layer-1 events from shadowing one another without a trace. “Silently” is doing the heavy lifting in that sentence.
What you actually have to do
Start with the version floors. Anything below Bor v2.10.0 is incompatible once Austin is active, and that threshold covers every Bor node role, producers included but not exclusively. Austin’s mainnet and Amoy activation blocks are documented in the public Bor v2.10.0 release. As of a check on Aug. 28, GitHub listed v2.10.1 as the most recent Bor release; v2.10.0 or newer is what gets you Austin compatibility.
For Heimdall, both validators and full nodes require v0.11.0.
Here’s the upside: both hardforks amount to straightforward binary upgrades. There’s no state migration and no genesis change involved. Provided your node never diverged, a resync isn’t necessary at all — a considerably lighter lift than Polygon operators have dealt with in the past.
Operators who’ve already passed the relevant height on an outdated client face more work. Install the applicable release, roll back to a pre-hardfork point if that’s required, and resync following Polygon’s guidance.
A final note on the token: Polygon Ecosystem Token is down -2.00% across the last 24 hours. Which is about what you’d predict. None of this registered beyond the operator community — and that is exactly the point of shipping fixes ahead of an incident instead of in response to one.