Iron Fish to End Remaining Network Support, Confirms Inflation Vulnerability

Iron Fish announced it will end all remaining support for its network. According to Odaily, the team traced unusual activity involving wIRON and the ChainPort bridge to an inflation vulnerability in the Iron Fish blockchain itself, rather than an issue with the bridge. The vulnerability dates to a Merkle tree implementation code change in early 2019 and involved the calculation of nullifiers, identifiers used to prevent double-spending privacy notes. It allowed an attacker to spend the same note more than once and transfer assets through ChainPort. The team said the code had been included in internal and external audits, but the vulnerability was not detected. Iron Fish has submitted a patch and included a detailed review in a related pull request. The team plans to close and archive the code repository.