Iron Fish ends support after 2019 bug enables double-spending

Iron Fish has announced an end to all remaining network support after uncovering an inflation bug dating back to early 2019 that allowed an attacker to spend the same shielded funds repeatedly and exit through the ChainPort bridge. Summary Iron Fish traced the exploit to its Merkle tree implementation and a flaw involving note nullifiers. The attacker repeatedly spent the same notes before aggregating funds and moving them through ChainPort. Internal and external audits covered the affected code path but failed to identify the vulnerability. The team said it committed a patch and included a postmortem before archiving its repository. According to Iron Fish’s announcement, the investigation began after the team noticed abnormal activity involving wIRON and ChainPort several days earlier. Working with the bridge operator and reviewing its logs, developers traced the problem to the Iron Fish blockchain itself. The statement did not disclose the total amount created through the exploit, the value withdrawn through the bridge, or a compensation plan for affected holders. Iron Fish traces repeated spending to a 2019 flaw The team traced the vulnerability to an early 2019 code commit impl...