Late Friday and Saturday, a series of events unfolded as attackers exploited a vulnerability in Litecoin's Mimblewimble Extension Block (MWEB) protocol, leading to a denial-of-service attack against major mining pools. This allowed for the temporary inclusion of invalid MWEB transactions into the blockchain before the network self-corrected. The Litecoin Core v0.21.5.4 release, which includes important security updates, has been advised for all users to upgrade to.
According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating normally. However, an examination of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks prior to the attack. This timeline suggests that the vulnerability was known and addressed by the developers before the exploit occurred. The attack involved a 13-block chain reorganization, effectively rewinding 32 minutes of network activity.
Security researchers have pointed out that the exploit seemed to involve a combination of the consensus vulnerability and a denial-of-service attack, with the latter designed to take patched mining nodes offline, allowing the inclusion of invalid transactions. The fact that the network was able to automatically recover from the 13-block reorganization once the denial-of-service attack stopped indicates that a sufficient amount of hashrate was running the updated code, eventually overpowering the attack. This incident highlights the differences in how various blockchain networks respond to exploits, with newer chains often able to coordinate upgrades more quickly than older proof-of-work networks like Litecoin and Bitcoin.