Privacy-Focused Public Chain Iron Fish Officially Shuts Down Network Due to Critical Vulnerability

October 31 — Privacy-focused public blockchain Iron Fish announced in a post that it will terminate all remaining support for the Iron Fish network later today. The team said it recently discovered unusual activity involving wIRON and the ChainPort cross-chain bridge. After investigating in collaboration with ChainPort, it confirmed that the root cause was an inflation vulnerability in the Iron Fish blockchain itself. The vulnerability traces back to a commit in the Merkle tree implementation from early 2019. The developer at the time implemented a standard Merkle tree, but a subtle difference in how the "note's nullifier" (the mechanism that allows users to spend their funds) was calculated let attackers use the same note multiple times. The attacker then exploited this vulnerability to aggregate multiple notes and complete the transfer of funds through the ChainPort cross-chain bridge.

Although this code path was within the scope of internal and external audits, the vulnerability went undetected. The team has submitted a fix patch along with a detailed post-mortem report, and will subsequently shut down and archive the Iron Fish codebase. In its statement, Iron Fish noted that software that cannot be upgraded instantly (as is the case for most projects in crypto) is extremely vulnerable, and that the ability to find and exploit complex code vulnerabilities is increasingly being "commoditized." The team thanked the community and wished the crypto industry a way forward.