A significant disruption occurred on the Litecoin network late Friday and Saturday, with a 13-block chain reorganization undoing approximately 32 minutes of network activity. This incident was caused by a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, which was exploited through a denial-of-service attack against major mining pools, allowing invalid MWEB transactions to bypass nodes that had not been updated.
The Litecoin Core v0.21.5.4 release has since been issued, containing crucial security updates and advising all users to upgrade. However, analysis of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack. This raises questions about the handling of the vulnerability and the subsequent attack, with some researchers arguing that the exploit was not a true zero-day attack, given that the vulnerability was known and patched privately beforehand.
The incident highlights the complexities and challenges associated with maintaining the security of older proof-of-work networks like Litecoin, particularly in scenarios where independent mining pools have discretion over when to apply updates, potentially creating windows of vulnerability.