Iron Fish is shutting down its network after an inflation bug let an attacker double-spend notes and exit via ChainPort

Iron Fish says it will end all remaining support for the network later today. Abnormal activity involving wIRON and the ChainPort bridge led to the discovery of an inflation bug traced to an early-2019 commit in the Merkle tree implementation. Because of nuances in nullifier calculation, an attacker spent the same note multiple times, aggregated the notes, and exited via ChainPort. The code path was covered by both internal and external audits but the bug was not caught. A patch and postmortem were committed before the repo is archived. The author argues non-upgradable crypto software is precarious as exploitation becomes commoditized.

✨ AI summary of the linked source — not editorial content.

Explore the topic

• Shut Down