Polygon patched a flaw that let one cheap transaction force heavy decoding work on every validator, shipping the fix in two hard forks before disclosing it.