Polygon Core Devs and Security Partners Resolve Critical Vulnerability

In the last couple of months, Polygon has been investing significant effort and resources into creating an ecosystem of security expert partners, with the goal of improving the security and robustness of all Polygon solutions and products. We have established relationships with a number of teams and individuals that have already helped us immensely; mainly by providing valuable feedback and helping with vulnerability discovery and resolutions.

Recently, a group of whitehat hackers on the bug bounty platform Immunefi disclosed a vulnerability in the Polygon PoS genesis contract. The Polygon core team engaged with the group and Immunefi’s expert team and immediately introduced a fix. The validator and full node communities were notified, and they rallied behind the core devs to upgrade the network. The upgrade was executed within 24 hours, at block #22156660, on Dec. 5. 

Considering the nature of this upgrade, it had to be executed without disclosing the actual vulnerability and without attracting too much attention. We are still finalizing our vulnerability disclosure policy and procedures, and for now we are trying to follow the “silent patches” policy introduced and used by the Geth team.

The upgrade was executed successfully, without impacting liveness and performance of the network in any major way. The vulnerability was fixed and damage was mitigated, with there being no material harm to the protocol and its end-users. All Polygon contracts and node implementations remain fully open source.

We are still working on closing the final proceedings with Immunefi and the whitehat hacker group, primarily in terms of their rewards and multiple rounds of reviews of the fixed vulnerability. We will post a detailed postmortem once this process is finished, likely by the end of next week. 

In addition to this upgrade, Polygon’s core team has carried out an extensive analysis and identified a number of existing processes that can be improved as well as actions that will make the network and our community more resilient in the future. We will share more details about these efforts and improvements in the future.

Thank you all for the continuous support. Please check our blog for the latest developments.

Let’s bring the world to Ethereum!

Website | Twitter | Ecosystem Twitter| Developer Twitter | Enterprise Twitter | Studios Twitter | Telegram | Reddit | Discord| Instagram | Facebook | LinkedIn

More from the Polygon Blog
Green Blockchain Summit 2.0: Agenda at a Glance 

Ethereum’s shift to Proof of Stake consensus, known as the Merge, has dramatically cut Polygon’s carbon dioxide emissions, opening the path to going beyond being carbon negative and toward empowering others to do the same. The conversation has shifted from blockchain sustainability to blockchain as a sustainability solution.  Join us for the second chapter of […]

Read More
Robinhood Selects Polygon to Launch Web3 Wallet Beta

Today, we are thrilled to announce that Robinhood has chosen Polygon as the first blockchain network to support its newly launched Web3 wallet. The Robinhood Wallet beta is now live for 10,000 iOS customers out of 1+ million who signed up for the waitlist in May. Together, Polygon and Robinhood are opening access to decentralized […]

Read More
What Is a zkEVM?

Zero-knowledge (ZK) tech is one of the most prominent and promising paths to scaling Ethereum. One popular use of ZK proofs to scale Ethereum is what’s known as a zkEVM (zero-knowledge Ethereum Virtual Machine). So what is a zkEVM, and how does it help us make Ethereum cheaper and more efficient to use? Understanding the […]

Read More
Polygon-Powered Icetea Labs Accelerator Launches With 6 Startups

Polygon has teamed up with Alpha Venture DAO and Icetea Labs to launch the inaugural Icetea Labs Accelerator Program for blockchain startups.  Working in a tight three-way partnership, Polygon is co-creating an accelerator to funnel resources, mentorship, education, and business acumen to promising Web3 companies from around the world. The startups selected for the accelerator […]

Read More
Apply to Polygon Bootcamp Africa and Kickstart Your Web3 Developer Journey

Applications are open for Polygon Bootcamp Africa, launched in partnership with Xend Finance! The eight-week intensive educational course and hackathon combo will put developers in Africa on the Web3 map.  This is Polygon’s biggest step in providing resources to developers, builders, and creators in Africa, and it comes during an important time.  An internet and […]

Read More
Starbucks Taps Polygon for Its 'Starbucks® Odyssey' Web3 Experience 

Today, we are thrilled to announce that Starbucks Coffee Company is working with Polygon to provide the blockchain technology to build its recently announced Web3 experience, Starbucks Odyssey. As a result of the partnership, this new Web3-powered experience will allow Starbucks Rewards loyalty program members and Starbucks partners (employees) in the United States to earn […]

Read More
Polygon Sponsors Moralis x Google 2022 ‘Defining DeFi’ Hackathon

Polygon has teamed up with Moralis and Google Cloud as an official Gold-Tier-Sponsor for the Moralis x Google 2022 Defining DeFi Hackathon!  From Oct. 3 to Nov. 11, hundreds of developers around the world will build the DeFi applications of their dreams, competing for prizes, bounties, and rewards from a pool of $155,000, with $50,000 […]

Read More
Polygon and OCEEF Bring Deep Sea Exploration to Web3

Entertainment can help people become more aware of and responsive to the problems we face. That's why Polygon has joined forces with the Ocean Conservation Exploration and Education Foundation (OCEEF) to advance ocean literacy by finding new and engaging ways to give people exposure to deep sea missions. The shared goal of this effort is […]

Read More
PolygonInsights - WEEK39

Hola readers! We announced Polygon Bootcamp Africa, an eight-week intensive educational course and hackathon combo, in partnership with Xend Finance, Polygon-based carbon compensation project Coorest has become the first Web3 initiative to have an officially verified carbon standard, and Quadrata, a passport network bringing the identity and compliance layer to public blockchains, is integrating its […]

Read More
crossmenuchevron-down-circle