On Friday and Saturday, the Litecoin network experienced a significant disruption due to a denial-of-service attack that exploited a vulnerability in its Mimblewimble Extension Block protocol, resulting in a 13-block chain reorganization to reverse the effects. The attack, which occurred at a time when the LTC price was around $54.81, rewound approximately 32 minutes of network activity. According to the Litecoin foundation, the bug was privately patched between March 19 and 26, more than four weeks before the attack occurred. However, the patch was not publicly disclosed until after the attack, leaving some mining pools vulnerable.
The foundation has since released Litecoin Core v0.21.5.4, which includes important security updates, and has advised all users to upgrade. Researchers have pointed out that the timeline of events, as shown in the litecoin-project GitHub repository, suggests that the vulnerability was known and patched privately before the attack, but the fix was not widely implemented. This created a window of opportunity for the attackers to exploit the vulnerability. The attack has raised concerns about the security of the Litecoin network and the need for more timely and transparent communication about vulnerabilities and patches.
Alex Shevchenko, CTO of NEAR Foundation's Aurora project, has argued that the denial-of-service attack and the MWEB bug were separate components, with the DoS designed to take patched mining nodes offline so that the unpatched ones would form the chain that included the invalid transactions. The fact that the network automatically handled the 13-block reorganization once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack. The incident highlights the challenges faced by older proof-of-work networks like Litecoin and bitcoin, which rely on independent mining pools choosing when to upgrade, creating a window of vulnerability when a security patch needs to reach everyone before an attacker exploits the gap.