TREE NEWS update: Polygon Labs released Bor v2.10.3 on October 15, patching two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution. The flaws involve an uncapped shared Keccak-256 cache and repeated computation of smart contract code hashes during parallel execution, affecting Bor v2.10.1 and v2.10.2 where BlockSTM V2 is enabled by default. Polygon said neither vulnerability has been exploited on mainnet or the Amoy testnet.
Polygon Releases Bor v2.10.3 to Fix Parallel Execution Vulnerabilities
The timing matters: BlockSTM V2 is a relatively new parallel execution engine, and this is its first notable security patch, so the disclosure tests how quickly validators and node operators upgrade. The attack surface is narrow — a shared cache and repeated code-hash computation — but DoS vectors in parallel execution can degrade block production for everyone on the chain, not just the affected node. The open question is upgrade uptake across the validator set, since any node still on v2.10.1 or v2.10.2 remains exposed.
Generated by AI for reference only.
Share on WeChat
Open WeChat → Scan → then tap "…" to send to a chat or Moments.
Tap "…" in the top-right corner to send to a chat or share to Moments.