Reviewer Details Iron Fish Inflation Bug Exploit

A reviewer on Ethos has published a negative postmortem on an inflation bug at Iron Fish. The reviewer, who holds an Ethos score of 1770, received 121 upvotes and one downvote for their detailed breakdown of the exploit.

The reviewer details how a flaw in the code led to billions of unauthorized tokens being minted through a bridge. According to the post, over 2.97 billion tokens were minted in under fourteen hours to two new wallets. This amount was substantially larger than the 76.9 million native tokens that had ever been issued by the project. The reviewer describes investigating the aftermath of the incident, stating, "I came to this case the way you walk into a house after a fire: late, with a flashlight, reading what the ashes still say." The user also highlights a statement from the Iron Fish team confirming the root cause: "After working with ChainPort and reviewing their logs, we discovered that the cause was an inflation bug in the Iron Fish blockchain itself."

A comment on the main review elaborates on the history of the codebase before the exploit occurred. The commenter points to a technical audit from June 2023. They note that the audit scope specifically included "the note, note commitment and Merkle tree implementations" within the code.

Based on feedback from the platform, Iron Fish operates as a privacy network. According to another reviewer, the project functions as a way to transfer assets into a private chain where a user's transaction history is completely hidden.

Overall sentiment on Ethos for the project is evenly split, featuring one negative review and one positive review in total. The positive review, written by a user with an Ethos score of 1225, focuses entirely on the privacy utility of the protocol rather than the recent exploit. Highlighting a completely different perspective, the user writes, "So your USDC remains private in an Ironfish wallet where no one would know the balance or history of your account. That's basically what you can do on IronFish."

Source: the review on Ethos Network. Project on X: @ironfishcrypto.