On Friday and Saturday, a series of events unfolded on the Litecoin network, culminating in a 13-block chain reorganization that effectively rewound 32 minutes of network activity. This was in response to a denial-of-service attack that leveraged a vulnerability within the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not been updated. The Litecoin Core v0.21.5.4 release has since been made available, containing crucial security updates that all users are advised to implement. According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating as normal.
However, a review of the litecoin-project GitHub repository reveals that the consensus vulnerability was addressed between March 19 and 26, more than four weeks before the attack occurred. This timeline has raised questions among researchers, who point out that the exploit appears to have been made possible by a window of vulnerability that existed due to the private patching of the bug and the subsequent delay in publicly disclosing and requiring the update for all mining pools. As a result, some miners were running the patched code, while others were still using the vulnerable version, seemingly allowing the attackers to target the unpatched nodes.
Concerns have been voiced by security experts, including Alex Shevchenko, CTO of NEAR Foundation's Aurora project, who highlights the complexity of the attack and the potential for similar exploits on other networks. The incident underscores the challenges faced by older proof-of-work networks like Litecoin and bitcoin in responding to security threats, particularly when compared to newer chains with more centralized validator sets. The full extent of the damage, including the amount of LTC affected and the value of any swaps completed before the reorganization, has not been disclosed.