Iron Fish ends support after 2019 bug enables double-spending

Iron Fish has announced an end to all remaining network support after uncovering an inflation bug dating back to early 2019 that allowed an attacker to spend the same shielded funds repeatedly and exit through the ChainPort bridge. Iron Fish traced the exploit to its Merkle tree implementation and a flaw involving note nullifiers. The attacker repeatedly spent the same notes before aggregating funds and moving them through ChainPort. Internal and external audits covered the affected code path but failed to identify the vulnerability. The team said it committed a patch and included a postmortem before archiving its repository.

Source: crypto.news