On Friday and Saturday, a series of events unfolded as a denial-of-service attack hit Litecoin, leveraging a vulnerability in its Mimblewimble Extension Block protocol to temporarily disrupt the network. The attack resulted in a 13-block chain reorganization, effectively rewinding 32 minutes of network activity. According to the Litecoin foundation, the bug was fully patched, and the network is now operating normally.
However, an examination of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack occurred. This patch was not publicly disclosed, and not all mining pools had updated, creating a window of vulnerability.
A prominent security researcher, bbsz, pointed out the discrepancy in the timeline of events, suggesting that the narrative presented by the Litecoin foundation may not be entirely accurate. The researcher argues that the attack was not a traditional zero-day, as the vulnerability had been known and patched privately prior to the exploit.
The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools are responsible for upgrading their own systems, creating potential windows of vulnerability. In contrast, newer chains with more centralized validator sets can coordinate upgrades and push patches network-wide more quickly. The full extent of the damage caused by the attack, including the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization, has not been disclosed.