On Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding 32 minutes of network activity. This reorganization was a response to a denial-of-service attack that took advantage of a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to be processed by nodes that had not been updated.
The Litecoin Core v0.21.5.4 release has since been made available, containing crucial security updates. According to the Litecoin Foundation, the bug has been fully patched and the network is now operating as normal. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack.
The consensus vulnerability and a separate denial-of-service vulnerability were both addressed in the release, which was made available after the attack had begun. The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools have the freedom to choose when to upgrade, potentially creating windows of vulnerability.
In contrast, newer chains with smaller, more centralized validator sets can coordinate upgrades and push patches network-wide more quickly. The full extent of the damage, including the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization, has not been disclosed.