Litecoin Recovers from Denial-of-Service Attack by Rewriting 13 Blocks

Late Friday and Saturday, the Litecoin network experienced a 13-block chain reorganization to counteract the effects of a denial-of-service attack. This attack, leveraging a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, temporarily rewound approximately 32 minutes of network activity. The exploit allowed for invalid MWEB transactions to be processed by nodes that had not yet updated, before the network's longest valid chain corrected them. In response, Litecoin Core v0.21.5.4 has been released, advising all users to upgrade due to important security updates.

According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating normally. However, security researchers have pointed out discrepancies between the foundation's account and the timeline of patches as recorded on the litecoin-project GitHub repository. The repository indicates that the consensus vulnerability was known and privately patched between March 19 and 26, more than four weeks before the attack occurred.

A separate denial-of-service vulnerability was patched on the morning of April 25, with both fixes being included in the release 0.21.5.4 after the attack had commenced. This sequence of events has raised concerns regarding the handling of vulnerabilities and the communication of patches to mining pools. Prominent researchers argue that the exploit involved a combination of the MWEB bug and a denial-of-service attack designed to take patched nodes offline, thereby allowing unpatched nodes to form a chain that included invalid transactions. The automatic handling of the 13-block reorganization by the network once the denial-of-service attack ceased suggests that a sufficient amount of hashrate was running updated code, eventually overpowering the attack.

This incident highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades more swiftly compared to older proof-of-work networks like Litecoin and Bitcoin, which rely on independent mining pools to choose when to upgrade. As of the latest update, the Litecoin Foundation has not publicly addressed the discrepancies in the timeline as presented on the GitHub repository, and the amount of LTC affected during the invalid block window, along with the value of any swaps completed before the reorganization, remains undisclosed.