Iron Fish has announced it will cease network support, after a vulnerability allowed double-spending of the same asset. The project will archive its code repository once the flaw is fixed.

Privacy blockchain project Iron Fish announced it will formally end all remaining support for the Iron Fish network later today, and archive its code repository after fixing the underlying vulnerability. The team said it previously detected abnormal activity involving the wIRON token and ChainPort cross-chain bridge. After collaborating with ChainPort to review logs, the issue was confirmed to stem from an inflation vulnerability in the Iron Fish blockchain itself, with its root cause traced to a code commit in the Merkle Tree implementation from early 2019. A flaw in the nullifier calculation mechanism for transaction notes allowed attackers to double-spend the same asset, then aggregate the related assets and transfer funds out via the ChainPort cross-chain bridge. The team added that this code path had been subject to both internal and external audits, yet the vulnerability remained undetected. Iron Fish has now submitted a vulnerability fix patch and attached a detailed post-mortem analysis report in the relevant pull request (PR), and will subsequently close and archive its code repository. The project also warned that most crypto networks cannot upgrade their code immediately, and are facing growing security risks. As the ability to discover and exploit complex code vulnerabilities becomes more widespread, the security protection pressure on blockchain projects is rising.