Control profile
- Transaction ordering
- Up to 105 proof-of-stake validators run Heimdall v2 consensus and Bor execution; two-thirds of voting power finalizes milestones.
- Escape hatch
- Ethereum withdrawals require a validator checkpoint and the upgradeable canonical bridge; there is no L1 force-inclusion route, and a consensus failure freezes withdrawals.
- Upgrade authority
- A 5-of-9 Ethereum multisig can upgrade staking, checkpoint, routing, withdrawal, and escrow contracts with no effective delay; a 5-of-8 commitchain multisig controls custom child-token contracts.
- Liveness record
- Heimdall v2 uses CometBFT and publishes deterministic milestone finality in seconds. The binding concern is not ordinary block production but the privileged control plane around staking, checkpoints, state-sync registration, and the canonical Ethereum bridge.
Ketju assessment
REJECTED under the same bright line applied to Mantle: a credible validator set does not cure instant privileged upgrades. Polygon documents that its multisigs do not directly censor normal or bridge transactions, an important distinction, but those signers can still change the contracts that define staking and exit. Without an enforceable notice period long enough for users to withdraw under the old rules, the escape hatch can be changed before it is used. This is a control rejection, not a claim that Polygon consensus is technically weak.
Observable review triggers
- Revisit if every regular staking and bridge upgrade has an enforceable on-chain delay of at least 7 days
- Revisit if state-sync sender and receiver registration is governed independently of the Polygon team
- Any reduction in the published 5-of-9 or 5-of-8 multisig thresholds
These triggers make the judgment monitorable. They are not predictions; each identifies a fact that would revoke or force review of the current assessment.
Advisor implementation questions
- Does the client’s thesis require censorship resistance, or primarily low-cost settlement?
- Can the client exit without cooperation from the normal transaction-ordering party?
- Who can upgrade bridges or contracts, and what delay applies?
- Does the asset introduce an issuer weaker than the chain grade?
- What evidence will show a halt, censorship event, or governance change?
Research sources
- Polygon Documentation — PoS overview — validator set, Heimdall, Bor, finality
- Polygon Documentation — Commit-chain multisigs — upgrade thresholds, bridge control, censorship scope
- Polygon Documentation — State transfer — checkpoint exit, state-sync registration
- L2BEAT — Polygon PoS — upgrade scope, no upgrade delay, exit window, withdrawal failure mode
Sources were accessed 2026-08-19. Primary documents and measured control conditions can change; the review triggers above govern off-cycle reassessment.