Iron Fish Shuts Down After Exploit

Privacy-focused blockchain Iron Fish has announced the termination of all remaining network support following the discovery of an inflation bug originating from an early 2019 code commit. According to CryptoNews, the vulnerability allowed an attacker to spend shielded funds repeatedly before aggregating the notes and moving them out through the ChainPort bridge.

Root Cause and Audits

Developers traced the exploit to an interaction between a standard Merkle tree implementation and the calculation of note nullifiers, which are designed to prevent repeated spending. The affected code path fell within the scope of both internal and external audits, including a core-protocol review finalized by Inversed Tech in June 2023, though the vulnerability went undetected by reviewers.

Before archiving its repository, the development team committed a patch and published a detailed postmortem. The investigation began after abnormal activity involving wIRON and ChainPort prompted developers to review logs alongside bridge operators.

Market Impact

Screenshots shared by traders indicated a sharp decline in the displayed market capitalization of wIRON, a wrapped token trading on Base, falling significantly alongside diminished liquidity pools on Aerodrome. Neither Iron Fish's announcement nor available on-chain metrics established the total amount created through the exploit or the exact value withdrawn.

Key facts

• Iron Fish ended network support following an inflation bug originating from an early 2019 code commit.
• The exploit allowed repeated spending of shielded funds and withdrawals through the ChainPort bridge.
• Affected code paths were previously reviewed during internal and external audits by firms including Inversed Tech.
• Developers committed a patch, provided a postmortem, and archived the repository.