Who controls it
- Transaction ordering
- Up to 105 proof-of-stake validators run Heimdall v2 consensus and Bor execution; two-thirds of voting power finalizes milestones.
- Escape hatch
- Withdrawals to Ethereum require a validator checkpoint and the upgradeable canonical bridge. There is no L1 force-inclusion route, and a consensus failure freezes withdrawals.
- Upgrade authority
- A 5-of-9 Ethereum multisig can upgrade staking, checkpoint, routing, withdrawal, and escrow contracts with no effective delay; a 5-of-8 commitchain multisig controls custom child-token contracts.
- Halts and outages
- Heimdall v2 uses CometBFT and publishes deterministic milestone finality in seconds. Ordinary block production is not the concern. The concern is the privileged control over staking, checkpoints, state-sync registration and the canonical Ethereum bridge.
Ketju assessment
Ketju does not approve Polygon PoS: a 5-of-9 multisig can instantly upgrade the staking and bridge contracts, so users have no window to withdraw under the old rules. Ketju applies the same fixed rule as for Mantle, and a credible validator set does not change the result. Polygon documents that its multisigs cannot directly censor normal or bridge transactions, and Ketju accepts that distinction. But the signers can still change the contracts that define staking and withdrawals. With no enforceable notice period, they can change the withdrawal path before a user can use it. Ketju makes no finding that Polygon’s consensus is technically weak.
Review triggers
- Revisit if every regular staking and bridge upgrade has an enforceable on-chain delay of at least 7 days
- Revisit if state-sync sender and receiver registration is governed independently of the Polygon team
- Any reduction in the published 5-of-9 or 5-of-8 multisig thresholds
Each trigger names a fact anyone can observe. If one occurs, Ketju will review the assessment again. None is a forecast.
Questions before use
- Does the client’s thesis require censorship resistance, or primarily low-cost settlement?
- Can the client withdraw without help from the party that normally orders transactions?
- Who can upgrade bridges or contracts, and what delay applies?
- Does the asset introduce an issuer weaker than the chain grade?
- What evidence will show a halt, censorship event, or governance change?
Research sources
- Polygon Documentation: PoS overview · validator set, Heimdall, Bor, finality
- Polygon Documentation: Commit-chain multisigs · upgrade thresholds, bridge control, censorship scope
- Polygon Documentation: State transfer · checkpoint exit, state-sync registration
- L2BEAT: Polygon PoS · upgrade scope, no upgrade delay, exit window, withdrawal failure mode
We read these sources on 2026-08-19. The documents and the control facts can change. If a review trigger occurs, Ketju reviews the chain before its next scheduled date.