Iron Fish announces it will cease network support after a vulnerability allowed the same asset to be double-spent; following the fix, the code repository will be archived.

BlockBeats news, October 31: Privacy blockchain project Iron Fish has announced that later today it will officially terminate all remaining support for the Iron Fish network and archive the code repository after fixing vulnerabilities.

Iron Fish stated that the team previously discovered abnormal activity involving wIRON and the ChainPort cross-chain bridge. After collaborating with ChainPort to investigate logs, it was confirmed that the issue originated from an inflation vulnerability in the Iron Fish blockchain itself, with roots traceable to a code commit in the Merkle Tree implementation from early 2019. Due to a flaw in the nullifier calculation mechanism for transaction notes, attackers were able to double-spend the same asset and subsequently aggregate the relevant assets and use the ChainPort cross-chain bridge to transfer funds out.

The team said that this code path had previously been included in internal and external audits, but the vulnerability remained undetected. Currently, Iron Fish has submitted a vulnerability fix patch and attached a detailed post-mortem analysis report in the relevant PR, after which it will close and archive the code repository.

Iron Fish also warned that most crypto networks cannot immediately upgrade their code and are facing increasingly severe security risks. As the ability to discover and exploit complex code vulnerabilities becomes more widespread, the security protection pressure on blockchain projects is rising.