Privacy-focused public blockchain Iron Fish has officially shut down its network due to a critical vulnerability.

PANews October 31 news: Privacy public chain Iron Fish posted a statement saying it will terminate all remaining support for the Iron Fish network later that day. The team said that recent abnormal activity was discovered in wIRON and the ChainPort cross-chain bridge. After collaborative investigation with ChainPort, it was confirmed that the root cause was an inflation vulnerability in the Iron Fish blockchain itself. The vulnerability can be traced back to a commit in the Merkle tree implementation in early 2019. At that time, developers implemented a standard Merkle tree, but due to a subtle difference in the calculation method of the "note’s nullifier" (the mechanism that allows users to use their funds), attackers were able to use the same note multiple times. Subsequently, the attackers exploited this vulnerability to aggregate multiple notes and completed the transfer of funds through the ChainPort cross-chain bridge.

Although this code path was within the scope of internal and external audits, the vulnerability was not discovered. The team has submitted a fix patch along with a detailed post-mortem report, and will subsequently close and archive the Iron Fish codebase. In its statement, Iron Fish pointed out that software that cannot be upgraded instantly (which is the case for most projects in the crypto field) is in an extremely vulnerable position; the ability to discover and exploit complex code vulnerabilities is increasingly becoming "commoditized." The team expressed gratitude to the community and wished the crypto industry a way forward.