Polygon Bor v2.10.3 Released, Patching Two DoS Security Vulnerabilities

On October 15, Polygon Labs officially announced the public release of Bor v2.10.3, which had previously been distributed on October 5 in a private version to validators and major infrastructure providers. This update fixes two medium-severity denial-of-service vulnerabilities in the BlockSTM V2 parallel block execution, both reported by security researchers via the Immunefi bug bounty program:

• Unbounded keccak256 cache issue: Attackers could exploit this by crafting specific transactions to fill hundreds of MiB of cache during the speculative execution phase, causing node memory exhaustion and delaying block production. The fix implements a capacity limit on the shared cache.
• Redundant code hash calculation during parallel execution: A single transaction could cause the parallel processor to take approximately 11 seconds, severely impacting node liveness. The fix caches code hash results on a per-transaction basis.

Additionally, this update includes several internal hardening measures: mempool address filtering now intercepts EIP-7702 SetCode authorizations, concurrency limits for the RPC batch execution pool are fixed, consistency in balance reads across self-destruct boundaries during parallel execution is corrected, and an automatic cleanup mechanism for stuck pending transactions is introduced (defaulting to 3 hours).

The affected versions are Bor v2.10.1 and v2.10.2. v2.10.3 is not a hard fork; nodes can upgrade individually without coordination. There have been no recorded exploits of these two vulnerabilities on the mainnet or the Amoy testnet.