On Friday and Saturday, a series of events unfolded as a denial-of-service attack targeted major mining pools on the Litecoin network, leveraging a vulnerability in its Mimblewimble Extension Block protocol. This led to a 13-block chain reorganization to reverse the effects, effectively rewinding 32 minutes of network activity. The attack was made possible by a bug that had been privately patched between March 19 and 26, but not publicly disclosed or mandated for all mining pools. As a result, attackers were able to exploit the vulnerability, allowing invalid transactions to be processed on nodes that had not been updated.
The Litecoin Core v0.21.5.4 release was subsequently issued, containing crucial security updates. According to the Litecoin Foundation, the bug was fully patched and the network returned to normal operation by Sunday morning. However, security researchers have raised concerns over the timeline of events, pointing out that the vulnerability was known and patched a month prior to the exploit, yet the fix had not been widely implemented. This created a window of opportunity for the attackers, who appeared to be aware of which mining pools were running the patched code and which were still vulnerable.
The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools have the autonomy to choose when to upgrade, potentially creating a window of vulnerability in the event of a security patch. The attack also underscores the importance of timely and transparent communication regarding security vulnerabilities and patches.