# Polygon Bor 2.10.3 Fixes Two BlockSTM Flaws After an 11-Second Test By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/33147 Published: 2026-10-16T09:27:39.000Z Updated: 2026-10-16T09:27:39.000Z Section: Technology > A code-hash test took about 11 seconds in parallel execution versus tens of milliseconds in serial execution. A separate cache test used about 690 MiB on a four-core configuration. Polygon Labs released Bor v2.10.3 Thursday, Oct. 15, to fix two medium-severity denial-of-service flaws in BlockSTM V2 after tests showed parallel block processing could delay imports by about 11 seconds. Bor imports blocks with a serial processor and BlockSTM V2 running in parallel, then relies on whichever finishes first; both are expected to produce the same result. The affected releases were Bor v2.10.1 and v2.10.2, where BlockSTM V2 was enabled by default. The technical findings add detail to [earlier coverage of Bor’s v2.10.3 update](). One flaw made the parallel processor recalculate a contract’s code hash when a transaction reread an account after code had been created or changed during that transaction. In the test, repeated reads kept the parallel processor busy for around 11 seconds, while serial execution completed the same transaction in tens of milliseconds. A valid transaction could repeat the read many times, creating repeated hash work under execution pricing that assumed clients would reuse a cached hash. Because cancellation took effect only between transactions, block import waited for the parallel work to finish. The other flaw let BlockSTM V2 and the block prefetcher share a cache with no size limit. A separate test used about 9.3 million gas, roughly 20% of the block gas target. On a four-core configuration, the block led a node to allocate about 690 MiB and take more than one second to import. Repeated blocks could make affected nodes fall behind. The 11-second delay and memory result came from separate tests of separate flaws. The vulnerabilities threatened node availability and block-import liveness, not transaction outcomes or consensus. The patch caps shared Keccak-256 and ecrecover caches and reuses code hashes per transaction and address. It leaves execution results unchanged and is not consensus-affecting. The private rollout reached Amoy on Oct. 5 and mainnet on Oct. 8, ahead of the public release. Bor v2.10.3 requires no hard fork, database schema change or resynchronization, and nodes can be upgraded individually. Operators on v2.10.2 or older were asked to upgrade. Polygon Labs said, “Neither issue was exploited on mainnet or Amoy as far as we know.” ## Links in this article - [earlier coverage of Bor’s v2.10.3 update](https://www.tokenpost.com/news/technology/32736)