Iron Fish discovers underlying inflation vulnerability, announces termination of remaining network support.

On October 31, the privacy public chain Iron Fish announced it will terminate all remaining support for its network.

Iron Fish stated that the team discovered anomalous activity involving wIRON and the ChainPort cross-chain bridge several days ago. Following a joint investigation, the root cause was confirmed to be an inflation vulnerability within the Iron Fish blockchain itself, rather than the cross-chain bridge. This vulnerability traces back to a Merkle tree implementation code commit made in early 2019, concerning the calculation logic for nullifiers in privacy notes (identifiers used to prevent double spending), which enabled attackers to repeatedly spend the same note and transfer assets out via the ChainPort cross-chain bridge.

The team stated that the relevant code had previously been included in both internal and external audits, but the vulnerability went undetected. To date, Iron Fish has submitted a fix patch and attached a detailed post-mortem to the relevant PR. Moving forward, the team will shut down and archive the code repository.