turtleabouttown

Later today, we are officially ending all remaining support for the Iron Fish network. A few days ago, we observed abnormal activity involving wIRON and the ChainPort bridge. After working with ChainPort and reviewing their logs, we discovered that the cause was an inflation bug in the Iron Fish blockchain itself. We traced the bug to a commit from early 2019 in the Merkle tree implementation. The developer at the time implemented a standard Merkle tree. However, because of nuances in how a note’s nullifier is calculated (the mechanism that lets a normal user spend their funds), the attacker was able to spend the same note more than once. The attacker then compounded the exploit, aggregated their notes, and exited through the ChainPort bridge. This code path was within the scope of both our external and internal audits, but the bug wasn’t caught during review. For closure, we’ve committed the patch for the exploit, with a detailed postmortem included in the PR, before shutting down and archiving the ironfish repo. The meta-analysis here is that software that can’t be upgraded immediately (most of crypto), is in an extremely precarious position. The ability to find and exploit vulnerabilities in technically complex code is becoming commoditized. Safety guardrails on US frontier models make it difficult for companies to use them to patch security vulnerabilities, while abliterated open-source models are approaching frontier capabilities. We wish everyone all the best, and we hope crypto finds a path through this. Thank you all.