Iron Fish discloses an inflation vulnerability originating f
Privacy-focused public blockchain Iron Fish announced it will terminate all remaining support for its network. The team said anomalous activity involving wIRON and the ChainPort cross-chain bridge originated from the chain’s own inflation vulnerability, not the cross-chain bridge; the vulnerability can be traced to a Merkle tree implementation commit in early 2019, affects nullifier calculation, and allows the same note to be spent repeatedly. A fix patch has been submitted, and the code repository will be closed and archived.
Event Timeline
- [10-31 00:22] Iron Fish to terminate support due to inflation vulnerability; vulnerability originates from 2019 Merkle tree implementation (Wu Shuo)
- [10-31 00:30] All remaining support for the network to be terminated; Iron Fish confirms vulnerability stems from an underlying inflation vulnerability (Odaily Planet Daily)
Background and Impact
On October 31, 2026, Wu Shuo and Odaily Planet Daily successively reported that privacy-focused public blockchain Iron Fish announced it will soon terminate all remaining support for its network. The team said that several days ago it discovered anomalous activity involving wIRON and the ChainPort cross-chain bridge, and a joint investigation confirmed that the root cause was an inflation vulnerability in the Iron Fish blockchain itself, not the cross-chain bridge. The two sources were consistent in their attribution of responsibility, both locating the problem in the Iron Fish chain itself.
The source