Polygon Releases Bor v2.10.3 To Patch Parallel Execution Vulnerabilities

Polygon Labs has officially announced the release of Bor v2.10.3, an essential software update designed to address security flaws within the network's execution layer. The update specifically patches two medium-risk Denial-of-Service (DoS) vulnerabilities discovered in the BlockSTM V2 parallel block execution engine. According to the development team, these issues primarily affected the recent v2.10.1 and v2.10.2 iterations of the Bor client, where parallel execution was enabled by default to optimize throughput.

Technical Overview of the BlockSTM V2 Security Fixes

The security audit identified two specific vectors that could have potentially compromised the stability of the Polygon PoS network. The first vulnerability involved a shared Keccak-256 cache that lacked a defined capacity limit, creating a risk of memory exhaustion. The second issue centered on the redundant calculation of smart contract code hashes during the parallel execution process, which could lead to inefficient resource allocation and potential node instability.

The update targets the following components:

• The Keccak-256 caching mechanism to prevent memory overflow.
• The hash calculation logic within parallel execution threads.
• The overall stability of the BlockSTM V2 engine across validator nodes.

Network Impact and Current Status

Despite the identification of these vulnerabilities, Polygon Labs confirmed that no exploitation has been detected on either the Polygon mainnet or the Amoy testnet. The proactive release of Bor v2.10.3 is intended to preempt any malicious activity that could leverage these design flaws to disrupt consensus or slow down block production.

The aforementioned vulnerabilities affected Bor v2.10.1 and v2.10.2 versions, where BlockSTM V2 is enabled by default. Currently, no exploitation has been found on the mainnet or the Amoy testnet.

This development underscores the ongoing efforts to refine parallel execution technologies, which are critical for scaling Ethereum Virtual Machine (EVM)-compatible blockchains. By allowing multiple transactions to be processed simultaneously rather than sequentially, BlockSTM V2 aims to significantly reduce latency and costs for users of the MATIC/POL ecosystem.

In light of these findings, all node operators and validators on the Polygon network are encouraged to upgrade to Bor v2.10.3 immediately to ensure the continued security and resilience of the infrastructure. The patch maintains the performance benefits of parallel execution while implementing necessary guardrails against resource-exhaustion attacks.