Litecoin Recovers from Denial-of-Service Attack by Rewriting 13 Blocks

On Friday and Saturday, a series of events unfolded as a denial-of-service attack hit Litecoin, leveraging a vulnerability in its Mimblewimble Extension Block (MWEB) protocol to execute invalid transactions. The attack rewound approximately 32 minutes of network activity before the longest valid chain corrected the issue. This vulnerability had been privately patched between March 19 and 26, but the fix had not been publicly disclosed or mandated for all mining pools, creating a window of opportunity for the attackers. They exploited this gap by targeting major mining pools, allowing invalid MWEB transactions to slip through nodes that had not updated. The Litecoin Core v0.21.5.4 was subsequently released, advising all users to upgrade due to important security updates. Prominent researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and patched a month before the exploit but not broadly communicated or enforced, leading to a situation where some miners were running patched code while others were still vulnerable. The attack involved a pre-funded wallet and a swap of LTC for ETH on a decentralized exchange, highlighting the complexity of the exploit. The fact that the network was able to automatically handle the 13-block reorganization once the denial-of-service attack stopped indicates that enough hashrate was running updated code to eventually overpower the attack. This incident underscores the challenges faced by older proof-of-work networks like Litecoin and Bitcoin, where independent mining pools can create windows of vulnerability when security patches are not universally applied in a timely manner.