Iron Fish Shuts Down Network Due to Major Vulnerability
Written with artificial intelligence.
Iron Fish, a privacy-focused blockchain, announced it will cease all support for its network following the discovery of a significant inflation vulnerability. This flaw, linked to the implementation of a Merkle tree in early 2019, allowed attackers to exploit the blockchain and transfer funds through the ChainPort cross-chain bridge.
Network Closure Announcement
On October 31, Iron Fish officially declared it would terminate all remaining support for its network later that day. The decision came after the team identified unusual activity involving wIRON and the ChainPort cross-chain bridge.
Details of the Vulnerability
Upon investigation, in collaboration with ChainPort, it was confirmed that the root cause was a significant inflation vulnerability inherent in the Iron Fish blockchain. This issue traces back to an implementation of a standard Merkle tree from early 2019. A subtle difference in the calculation of the note’s nullifier, which is crucial for allowing users to utilize their funds, enabled attackers to reuse the same note multiple times.
Impact and Response
Attackers exploited this vulnerability to aggregate multiple notes and successfully transfer funds through the ChainPort bridge. Although the code path was within the scope of internal and external audits, the vulnerability remained undetected. The Iron Fish team has submitted a patch to fix the issue and provided a detailed post-mortem analysis report. They will subsequently close and archive the Iron Fish codebase.
In their statement, Iron Fish emphasized that software unable to upgrade immediately — a common situation in many crypto projects — is at a highly vulnerable position. They also noted that the ability to discover and exploit complex code vulnerabilities is increasingly becoming commoditized. The team expressed gratitude to the community and wished the broader crypto industry success in finding solutions.