Polygon Bor v2.10.3 fixes two BlockSTM V2 denial-of-service bugs that can stall or exhaust PoS nodes

Summary

Polygon Labs published Bor v2.10.3 as a security and stability release and disclosed two Medium-severity denial-of-service issues in BlockSTM V2 parallel block execution, both reported through the Immunefi bug bounty program. One is an unbounded shared keccak256 cache; the other is repeated full code-hash computation during parallel execution. Neither issue is consensus-affecting.

Affected

• Polygon Bor v2.10.1 and v2.10.2 (BlockSTM V2 enabled by default)
• Fixed in Bor v2.10.3 (also distributed earlier to validators as v2.10.3-priv / v2.10.3-beta-priv)

Impact

1. Unbounded shared keccak256 cache (Medium): the parallel processor and execution prefetcher shared a per-block hash cache with no size limit, which speculative execution could fill with hundreds of MiB. Polygon's test block (~9.3M gas) caused about 690 MiB of allocation and over one second of import time on a 4-core setup; repeated blocks could cause block lag and memory exhaustion on lightly provisioned nodes. 2. Repeated code hashing in parallel execution (Medium): reading the code hash of an account whose code changed earlier in the same transaction recomputed the full hash each time. One transaction against a maximum-size contract took about 11 seconds in the parallel processor versus tens of milliseconds serially, so one such transaction per block could delay import by several seconds on every BlockSTM V2 node (liveness risk). Polygon states that, as far as it knows, neither issue was exploited on mainnet or the Amoy testnet.

Recommended actions

• Upgrade Polygon PoS nodes to Bor v2.10.3. It is not a hardfork; nodes can be upgraded one at a time, in any order.
• Before restarting, check [heimdall] timeout in config.toml: it is now honoured (default 30s), and older sample configs set it to 5s.

Source & attribution

This 0xCERT advisory summarises the "Bor Security Bug Fix Review (v2.10.3)" post by Polygon Labs on the Polygon forum (https://forum.polygon.technology/t/bor-security-bug-fix-review-v2-10-3/22379) and the Bor v2.10.3 release notes (https://github.com/0xPolygon/bor/releases/tag/v2.10.3). The issues were reported via Immunefi; Polygon did not name the reporters. Details may change; refer to the original source for the authoritative record.