Late Friday and Saturday, a series of events unfolded as a denial-of-service attack on Litecoin's network led to a 13-block chain reorganization, effectively rewinding 32 minutes of network activity. The attack exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not yet been updated.
In response, Litecoin Core v0.21.5.4 was released, containing crucial security updates. According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating normally. However, an examination of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack occurred.
This timeline has raised concerns among researchers, who point out that the patch was not publicly disclosed or mandated for all mining pools, creating a window of vulnerability. The attack involved a separate denial-of-service vulnerability that was patched on the morning of April 25, with both fixes being rolled into the release 0.21.5.4 after the attack had begun. The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools can create a window of vulnerability when security patches need to be implemented quickly. Blockchain data shows that the attacker had pre-funded a wallet 38 hours before the exploit, with the destination address configured to swap LTC into ETH on a decentralized exchange.
The automatic handling of the 13-block reorganization by the network once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack. The incident serves as a reminder of the differing approaches to handling exploits across various networks, with newer chains often coordinating upgrades more swiftly through centralized validator sets.