Iron Fish Discovers Underlying Inflation Vulnerability, Announces It Will End Remaining Network Support

According to Shenchao TechFlow, on October 31, privacy public blockchain Iron Fish announced that it would terminate all remaining support for its network.

Iron Fish said the team had discovered unusual activity involving wIRON and the ChainPort cross-chain bridge several days ago. Following a joint investigation, it confirmed that the root cause was an inflation vulnerability in the Iron Fish blockchain itself, not in the cross-chain bridge. The vulnerability traces back to a Merkle tree implementation code commit in early 2019 involving the calculation logic of nullifiers (identifiers used to prevent double-spending) in privacy notes, which allowed attackers to double-spend the same note and transfer assets out through the ChainPort cross-chain bridge.

The team said the relevant code had previously been included in both internal and external audit scopes, but the vulnerability was not detected. Iron Fish has now submitted a patch and attached a detailed post-mortem in the related PR. The team will subsequently close and archive the code repository.

Source: Shenchao TechFlow