On Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding 32 minutes of network activity. This was in response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not been updated. The Litecoin Core v0.21.5.4 release has since been made available, containing crucial security updates, including a patch for the vulnerability. According to the Litecoin Foundation, the bug has been fully addressed, and the network is now operating as normal.
However, security researchers have pointed out discrepancies in the timeline of events, citing the litecoin-project GitHub repository, which indicates that the consensus vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack. The repository also shows that a separate denial-of-service vulnerability was patched on the morning of April 25, with both fixes being included in the release 0.21.5.4 the same afternoon, after the attack had begun.
This has raised questions about the nature of the exploit, with some arguing that it was not a true zero-day attack, given that the vulnerability was known and patched privately a month prior. The attack has highlighted the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools have the discretion to choose when to upgrade, creating a window of vulnerability that can be exploited by attackers. The full extent of the damage, including the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization, has not been disclosed.