On Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding 32 minutes of network activity. This was in response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not been updated. The attack was made possible by a bug that had been privately patched between March 19 and 26, but the fix had not been publicly disclosed or mandated for all mining pools, creating a window of vulnerability.
The Litecoin Core v0.21.5.4 release, which includes important security updates, has been made available, and all users are advised to upgrade. According to the Litecoin Foundation, the bug has been fully patched, and the network is operating normally. However, security researchers have raised concerns, pointing out that the GitHub repository suggests the vulnerability was known and patched a month before the exploit, but the fix was not broadcast publicly, allowing attackers to target unpatched mining pools.
The incident highlights the differences in how various networks respond to exploits, with newer chains being able to coordinate upgrades quickly, while older proof-of-work networks like Litecoin rely on independent mining pools to upgrade, creating a window of vulnerability.