On Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding 32 minutes of network activity. This reorganization was a response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not been updated.
The Litecoin Core v0.21.5.4 release was subsequently issued, containing crucial security updates. According to the Litecoin Foundation, the bug was fully patched, and the network returned to normal operation by Sunday morning. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was privately patched between March 19 and 26, roughly four weeks prior to the attack. This has raised concerns about the window of vulnerability that existed due to the delay in publicly disclosing and requiring the patch for all mining pools.
The attack involved a separate denial-of-service vulnerability that was patched on April 25, with both fixes being rolled into the release 0.21.5.4 after the attack had begun. The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools have the discretion to choose when to upgrade, potentially creating a window of vulnerability. As the situation continues to unfold, the amount of LTC affected during the invalid block window and the value of any completed swaps remain undisclosed.