Polygon Discloses Security Flaws Fixed in POL Network's Austin and Kyoto Hard Forks

Austin and Kyoto Hard Forks Close Quiet Flaws

Polygon Labs has publicly disclosed several previously private security vulnerabilities that could have disrupted its proof-of-stake network, confirming that fixes were already deployed through two recent hard forks. The affected software spans the chain's two core clients — Bor, which handles block production, and Heimdall, the consensus layer that coordinates validators — and includes denial-of-service risks, validator resource exhaustion, and flaws touching checkpoint and milestone processing, according to a disclosure from Polygon Labs' Validators Support Team. Checkpoints and milestones are the periodic commitments through which Heimdall finalizes Bor's state to Ethereum, so defects in that path carry outsized risk for finality guarantees. The upgrades themselves were engineered for discretion: the Austin and Kyoto hard forks were deployed privately and tested before activation on mainnet, with public disclosure following only after the Polygon (POL) network was already patched — a coordinated-disclosure rhythm designed to give every node operator time to upgrade. The most severe issue sat in Heimdall, where a specially crafted transaction could force validators to perform excessive processing work, potentially disrupting the network. The Austin hard fork separately addressed two denial-of-service risks in Bor that could have slowed block processing or crashed nodes outright. Polygon stated that none of the vulnerabilities were observed being exploited on mainnet and that fixes went in proactively before details became public. The pressure to upgrade is not theoretical: nodes running older versions past the hard fork activation heights have already fallen out of consensus and must update to rejoin the canonical chain. Bor v2.10.0 is required for all Polygon PoS nodes, while Heimdall v0.11.0 is required for validators and full nodes, with both upgrades active on mainnet. POL, the native token formerly known as MATIC, was changing hands near $0.10, down about 4% over the past week but up 44% on the month and 2.3% year to date, per CoinGecko data.

Lawson Counter Trial Puts Polygon's Rails to Work

While engineers harden the chain's core, Polygon's rails are being stress-tested at Japanese convenience-store counters. Payments provider NetStars ran a stablecoin point-of-sale trial on August 17 at a Lawson Gate City Osaki Atrium store in Tokyo, the second phase of a series that began on August 6, when Lawson, blockchain firm HashPort and telecom KDDI trialed POS-linked payments with the yen stablecoin JPYC on Polygon at Lawson's Takanawa Gateway City location using HashPort Wallet. The latest experiment connected Lawson's existing cash register system to Stablecoin Pay, NetStars' merchant service built on its StarPay platform, testing whether everyday store operations could absorb on-chain settlement without disruption — an early working blueprint for PayFi at retail. Three assets moved across three chains: dollar-pegged USDC and USDT on Solana, Morph and Polygon, plus JPYC on Polygon, with customers paying from a MetaMask wallet — readers setting up can follow our guide to connecting the Polygon network to MetaMask — through a browser-based DApp flow NetStars developed for the trial. Staff selected the existing barcode-payment option and scanned the customer's code; the register auto-identified the method and sent it to NetStars, which returned the result, with no new buttons added to the terminal. Speed was the headline result: payments observed during the visit completed in roughly five seconds, which NetStars COO Hisahisa Osafuku called a significant achievement for crowded lunchtime queues. Users did not need to hold each chain's native gas token such as SOL or POL; NetStars fronts those fees and recovers them through a processing charge, separate from the 0.98% merchant fee it publishes. The regulatory edge is sharper: USDT does not appear on the Financial Services Agency's latest registered asset list for Japan's electronic payment providers, and NetStars says it is negotiating with the regulator over how USDT accepted at the register should be converted into yen, with the conversion route — domestic or overseas — still undecided. Lawson's Taro Tamura called the test preparatory groundwork rather than a commercial launch, with no franchisee demand recorded yet. Readers tracking the market in real time can follow live spot and futures prices on Bitget.

Security First, Then the Checkout

Read together, the two items sketch one arc: a network preparing for real-world usage on both fronts. Polygon Labs' own disclosure — the primary record here — states plainly that no vulnerability was exploited on mainnet and that Bor v2.10.0 and Heimdall v0.11.0 are now mandatory, a quietly executed upgrade path that retail partners such as Lawson effectively depend on. Gas abstraction in the Lawson trial, where the payer never touches POL, shows how the token can stay in the background even as payment volume scales. POL slipped roughly 5% over the past 24 hours, and broader altcoin market softness keeps near-term sentiment muted despite the token's month-long gain.