Late Friday and Saturday, a series of events unfolded on the Litecoin network, beginning with a 13-block chain reorganization that essentially rewound approximately 32 minutes of network activity. This reorganization was a response to an attack that leveraged a vulnerability in Litecoin's Mimblewimble Extension Block (MWEB) protocol, allowing for a denial-of-service (DoS) attack against major mining pools. The attackers exploited this bug to sneak invalid MWEB transactions past nodes that had not been updated, before the network's longest valid chain corrected them. Following the incident, Litecoin Core v0.21.5.4 was released, with all users advised to upgrade due to important security updates included in the release.
According to the Litecoin Foundation, the bug was fully patched, and the network returned to normal operation by Sunday morning. However, security researchers have pointed out discrepancies between the Foundation's account and the timeline of events as recorded on the litecoin-project GitHub repository. The repository indicates that the consensus vulnerability was known and privately patched between March 19 and 26, roughly a month before the attack occurred. This patch, along with a fix for a separate DoS vulnerability, was included in the release 0.21.5.4, which was rolled out after the attack had begun.
The term 'zero-day' refers to a vulnerability that is unknown to the defenders of a network at the time it is exploited. In this case, the existence of the consensus vulnerability and its patch before the attack raises questions about the timing and communication of security fixes within the Litecoin community.
The attack involved a sophisticated strategy, including pre-funding a wallet 38 hours before the exploit and configuring it to swap LTC for ETH on a decentralized exchange immediately after. Analysts, including Alex Shevchenko, CTO of NEAR Foundation's Aurora project, have suggested that the DoS attack was designed to disable mining nodes that had been updated, allowing the attackers to exploit the unpatched nodes and include invalid transactions in the blockchain. The automatic handling of the 13-block reorganization by the network once the DoS stopped indicates that enough of the network's hashrate was running updated code to eventually overpower the attack. This incident highlights the differences in how various blockchain networks respond to exploits, with newer chains often able to coordinate upgrades more quickly due to their smaller, more centralized validator sets.
In contrast, older proof-of-work networks like Litecoin and Bitcoin, which rely on independent mining pools to choose when to upgrade, can face challenges in rapidly deploying security patches across the entire network. As of the last update, the Litecoin Foundation had not publicly addressed the discrepancies in the timeline of events as presented on the GitHub repository, and details regarding the amount of LTC involved in the invalid transactions and the value of any swaps completed before the reorganization remain undisclosed.