A series of events unfolded over the weekend as a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding 32 minutes of network activity. This was in response to a denial-of-service attack that took advantage of a vulnerability in the Mimblewimble Extension Block (MWEB) protocol. The attack allowed invalid MWEB transactions to be processed by nodes that had not been updated, before the network's longest valid chain corrected them. The Litecoin Core v0.21.5.4 release has been made available, which includes important security updates.
However, researchers have pointed out that the vulnerability was privately patched between March 19 and 26, more than four weeks before the attack, raising concerns about the handling of the exploit. The attack has been attributed to a combination of a denial-of-service vulnerability and a consensus vulnerability, both of which were patched, but not publicly disclosed until after the attack.
The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools can create a window of vulnerability when security patches need to be implemented quickly.