Iron Fish announces it will cease network support after a vulnerability allowed the same asset to be double-spent; following the fix, the code repository will be archived.

October 31: Privacy blockchain project Iron Fish has announced that later today it will officially terminate all remaining support for the Iron Fish network and archive the code repository after fixing the vulnerability.

Iron Fish stated that the team previously discovered abnormal activity involving wIRON and the ChainPort cross-chain bridge. After collaborating with ChainPort to investigate the logs, it was confirmed that the issue originated from an inflation vulnerability in the Iron Fish blockchain itself, with the root cause traceable to a code commit in the Merkle Tree implementation from early 2019. Due to a flaw in the nullifier calculation mechanism for transaction notes, attackers were able to double-spend the same asset and subsequently aggregate the relevant assets and transfer funds out via the ChainPort cross-chain bridge.

The team said that this code path had previously been included in internal and external audit scopes, but the vulnerability remained undetected. Currently, Iron Fish has submitted a vulnerability fix patch and attached a detailed post-mortem analysis report in the relevant PR, after which it will close and archive the code repository.

Iron Fish also warned that most crypto networks cannot immediately upgrade their code and are facing increasingly severe security risks. As the ability to discover and exploit complex code vulnerabilities gradually becomes more widespread, the security protection pressure on blockchain projects is rising.