Iron Fish’s merged PR #5762 describes a consensus-breaking Merkle-tree bug that could allow the same note to be spent twice. The fix is scoped to a new chain with a newly generated genesis.
What the PR says
The project’s pull request says the old rule let a note owner authenticate an inserted output at an unpopulated private position and derive an extra nullifier. Its test plan reproduced two old-rule spend proofs for the same note; both failed against the corrected consensus anchor.
Fresh-chain boundary
PR #5762 says the change alters consensus Merkle roots, makes existing mainnet and testnet histories incompatible and provides no upgrade path for existing chains. The PR was merged on October 30, 2026.
BlockBeats reported that Iron Fish would stop network support and archive its repository after the vulnerability. The current GitHub repository API still reports the repository as not archived, so that shutdown and archive status is not presented here as completed.
Source: BlockBeats flash, Iron Fish PR #5762 and Iron Fish repository API metadata, accessed October 31, 2026.