Late Friday and Saturday, a series of events unfolded on the Litecoin network, starting with a denial-of-service attack that targeted major mining pools, taking advantage of a vulnerability in its Mimblewimble Extension Block protocol. The attack, which occurred at a time when the price of LTC was $55.53, resulted in a 13-block chain reorganization, effectively rewinding 32 minutes of network activity. This reorganization was necessary to reverse the effects of the attack, which had enabled invalid transactions to be processed. The Litecoin Core v0.21.5.4 update has been released, which includes important security patches, and all users are advised to upgrade as soon as possible.
According to the Litecoin Foundation, the bug that made the attack possible was fully patched, and the network is now operating as normal. However, some researchers have raised concerns about the timeline of events, pointing out that the vulnerability was privately patched between March 19 and 26, more than four weeks before the attack occurred.
The consensus vulnerability was known and patched, but the fix had not been made public or mandated for all mining pools, creating a window of opportunity for the attackers. Alex Shevchenko, CTO of NEAR Foundation's Aurora project, has also expressed concerns about the exploit, suggesting that the denial-of-service attack and the MWEB bug were separate components, with the DoS designed to take patched mining nodes offline so that the unpatched ones would form the chain that included the invalid transactions.
The fact that the network was able to automatically handle the 13-block reorganization once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack. This incident highlights the differences in how various networks respond to exploits and the challenges faced by older proof-of-work networks like Litecoin and bitcoin, which rely on independent mining pools to upgrade and patch vulnerabilities.