Privacy public chain Iron Fish will terminate the network’s remaining support, confirming a 2019 Merkle tree inflation bug

Iron Fish is a Layer-1 network centered on private transactions, using a note commitment and nullifier mechanism similar to Zcash Sapling to hide amounts and transacting parties. Its Merkle tree is used to prove that a note exists in the commitment tree, while the nullifier serves as a public identifier to prevent the same note from being spent twice. The Merkle tree implementation from early 2019 chose a padding method of “copying the left branch when the right branch is empty,” and this rule was carried over into later production code. Because nullifier calculation depends on the note’s private position in the tree, once an attacker controlled the spending authority of their own note, they could construct proofs with different paths that produce the same root but different nullifiers, thereby spending the same note multiple times and creating excess output.

ChainPort, as the cross-chain exit for wIRON, became the channel through which the attacker transferred the results out of the native chain. After discovering abnormal wIRON issuance on Base, the team worked with the bridge side and ultimately identified the root cause as the native chain rather than the bridge itself. The GitHub postmortem makes clear that the fix changed the consensus root calculation rule, so it only applies to a new chain started from a new genesis block; the history of the existing mainnet and testnet cannot be made compatible through a simple upgrade. This is consistent with the upgrade constraints faced by most early privacy or custom-consensus chains: once state accumulates under the old rule, a rule change constitutes a hard fork and is difficult to make backward-compatible.

Compared with related circuit issues disclosed in Zcash pools such as Orchard, this incident in Iron Fish was a defect in the interaction between the tree padding rule and nullifier position binding, rather than a direct allowance to spend someone else’s note. The audit covered the code path but did not catch this aliasing case, reflecting the difficulty of verifying cross-component invariants in privacy proof systems, such as root binding, positional uniqueness, and nullifier uniqueness. Iron Fish chose to terminate support and archive the repository rather than attempt to forcibly upgrade the existing chain, meaning users holding native IRON or wIRON through the bridge must handle the remaining assets and bridge positions themselves, and there is no further maintenance path from the team.

For privacy public chains, such incidents highlight the risks of long-running complex cryptographic implementations in environments where immediate upgrades are not possible. Improvements in bug discovery capability, including model-assisted methods, make subtle differences in historical code easier to exploit, while bridges amplify the propagation of native-chain inflation to other chains. One indicator to watch is the actual redemption and supply adjustment situation of the relevant bridge and wrapped asset, as well as whether projects with similarly non-upgradeable privacy or custom tree implementations conduct targeted reviews.

ABAB News · Laws of cognition

1. Auditing code paths does not mean capturing cross-component positional aliasing invariants.

2. Once consensus rules that cannot be upgraded immediately accumulate history, a fix becomes incompatible with the old chain.

3. Bridge exits turn native-chain inflation into a cross-chain transferable supply imbalance.