Late Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, reversing approximately 32 minutes of network activity. This reorganization was a response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to be processed by nodes that had not been updated. The Litecoin Foundation has since confirmed that the bug was fully patched and the network is operating normally. However, an analysis of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack.
This timeline has raised concerns among researchers, who point out that the window between the private patch and the public disclosure created an opportunity for attackers to exploit the vulnerability. The attack involved a denial-of-service component designed to take patched mining nodes offline, allowing unpatched nodes to form a chain that included invalid transactions. Fortunately, the network's longest valid chain eventually corrected the invalid transactions, and the 13-block reorganization ensured the integrity of the network.
The incident highlights the differences in how various blockchain networks respond to exploits and the importance of prompt patching and disclosure.