On Friday and Saturday, a series of events led to a 13-block chain reorganization on the Litecoin network, effectively rewinding 32 minutes of activity. This was in response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block protocol. The attack allowed invalid transactions to bypass nodes that had not been updated, before the network's longest valid chain corrected them.
The Litecoin Core v0.21.5.4 release contains crucial security updates and users are advised to upgrade. According to the Litecoin Foundation, the bug has been fully patched and the network is now operating normally. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and patched privately a month before the attack.
The consensus vulnerability was patched between March 19 and 26, while a separate denial-of-service vulnerability was patched on April 25. Both fixes were included in the release 0.21.5.4 after the attack had begun. The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools choose when to upgrade, creating a window of vulnerability.
The amount of LTC affected during the invalid block window and the value of any swaps completed before the reorganization have not been disclosed.