Polygon releases Bor v2.10.3 to fix parallel execution vulnerabilities, clarifies no exploitation has been found

Polygon's Bor v2.10.3 patch addresses two medium-severity denial-of-service flaws inside BlockSTM V2, the parallel block execution engine that Bor enabled by default starting in v2.10.1. The first issue is an unbounded shared Keccak-256 cache, and the second is redundant recomputation of smart contract code hashes during parallel execution, both of which could degrade node performance under adversarial or heavy load rather than directly draining funds. Because Polygon Labs says no exploitation has been observed on the mainnet or the Amoy testnet, the practical risk is currently operational rather than financial, but node operators running affected versions carry the exposure until they upgrade. Watch whether the team publishes a fuller technical postmortem, whether other clients or chains reusing BlockSTM-style parallelism audit similar caching and hashing paths, and whether validator upgrade adoption is tracked publicly.