Odaily reports: Privacy-focused public chain Iron Fish has announced that it will terminate all remaining support for its network. A few days ago, the team discovered anomalous activity involving wIRON and the ChainPort cross-chain bridge. A joint investigation confirmed that the root cause was an inflation vulnerability in the Iron Fish blockchain itself, rather than the cross-chain bridge. The vulnerability can be traced back to a Merkle tree implementation code commit in early 2019, involving the calculation logic of the nullifier in privacy notes (an identifier used to prevent double-spending), which allowed attackers to double-spend the same note and transfer assets out through the ChainPort cross-chain bridge. The team stated that the relevant code had previously been included in internal and external audit scopes, but the vulnerability was not discovered. Iron Fish has now submitted a fix patch and attached a detailed post-mortem in the relevant PR; going forward, the team will close and archive the code repository.
