Polygon Releases Bor v2.10.3 With Two Denial-of-Service Fixes

Polygon has published Bor v2.10.3 after most validators and major infrastructure providers received private builds that fixed two medium-severity denial-of-service risks in BlockSTM V2. Polygon says neither issue was exploited on mainnet or the Amoy testnet. Follow verified network updates through OrangeX.com News.

What was fixed

The first issue involved an unbounded shared cache for keccak256 results during speculative parallel execution. In Polygon's test, a block using about 9.3 million gas—roughly 20% of the block gas target—caused about 690 MiB of allocation and took more than one second to import on a four-core setup. Repeated use could have pushed nodes behind or exhausted memory. Bor v2.10.3 now caps the shared keccak256 and ecrecover caches.

The second issue repeatedly recalculated a contract code hash in the parallel processor. One valid transaction could keep that processor busy for about 11 seconds even though serial execution finished in tens of milliseconds. The fix memoizes the code hash by transaction and address and invalidates it when code changes or is reverted.

Both flaws affected Bor v2.10.1 and v2.10.2, where BlockSTM V2 is enabled by default. Polygon classified both as medium severity and said they threatened liveness rather than consensus correctness.

Rollout and additional hardening

Private builds reached Amoy on October 5 and mainnet on October 8 before the stable code became public. The release is not a hard fork, so operators can upgrade nodes individually. It also tightens EIP-7702 authorization filtering, enforces RPC execution-pool limits and timeouts, aligns a parallel balance-read edge case with serial execution, and evicts stranded pending transactions after a default three hours.

Operators should verify the Heimdall timeout setting before restarting because the configured value is now enforced and the default is 30 seconds. More security coverage is available in OrangeX.com Security, including the OrangeX.com report on the UNCX Vesting V2 exploit.

OrangeX.com Analysis

The important signal is the staged disclosure: sensitive fixes were deployed privately before technical details became public. That lowers immediate exposure, but node operators running v2.10.1 or v2.10.2 still need to upgrade. Because Polygon says the issues were not exploited and were not consensus-affecting, claims of a chain compromise would be unsupported. The next items to watch are upgrade adoption, any post-release regressions and independent confirmation that the new cache bounds and memoization remain effective under production load.