Late Friday and Saturday, a series of events unfolded as a 13-block chain reorganization on the Litecoin network rewound approximately 32 minutes of network activity. This was in response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block protocol, allowing invalid transactions to bypass nodes that had not been updated. The Litecoin Core v0.21.5.4 release contains critical security updates and users are advised to upgrade. According to the Litecoin Foundation, the bug has been fully patched and the network is now operating as normal.
However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was privately patched between March 19 and 26, roughly four weeks prior to the attack. The consensus vulnerability allowed for an invalid MWEB peg-out, while a separate denial-of-service vulnerability was patched on April 25.
Both fixes were included in the release 0.21.5.4, which was rolled out after the attack had begun. The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools have the discretion to choose when to upgrade, creating a window of vulnerability in the event of a security patch. Prominent researchers have raised concerns over the handling of the exploit, with some arguing that the denial-of-service attack and the MWEB bug were separate components designed to take patched mining nodes offline.
The fact that the network automatically handled the 13-block reorganization once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack.