On Friday and Saturday, a series of events unfolded as a 13-block chain reorganization took place on the Litecoin network, effectively reversing approximately 32 minutes of network activity. This was in response to an attack that leveraged a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not been updated. The Litecoin Core v0.21.5.4 release was subsequently announced, urging all users to upgrade due to important security updates.
While the foundation reported that the bug was fully patched and the network was operating normally by Sunday morning, researchers pointed out discrepancies in the timeline based on the litecoin-project GitHub repository. It was revealed that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack occurred.
Furthermore, a separate denial-of-service vulnerability was patched on April 25. Both fixes were incorporated into the release 0.21.5.4 after the attack had begun. The term 'zero-day' refers to a vulnerability that is unknown to defenders at the time of an attack.
However, Litecoin's commit history showed that the consensus vulnerability was known and patched a month before the exploit, but the fix had not been publicly announced or mandated for all mining pools. This created a window of opportunity for attackers, who appeared to be aware of which miners were running the patched code and which were still vulnerable. Concerns were raised by Alex Shevchenko, CTO of NEAR Foundation's Aurora project, in a thread, highlighting the pre-funding of a wallet 38 hours before the exploit and the destination address being configured to swap LTC for ETH on a decentralized exchange.
The denial-of-service attack and the MWEB bug were seen as separate components, with the DoS designed to take patched mining nodes offline, allowing the unpatched ones to form a chain that included the invalid transactions. The network's automatic handling of the 13-block reorganization once the DoS stopped suggested that enough hashrate was running updated code to eventually overpower the attack. The incident highlights the differences in how attacks on various networks are handled, depending on the maintainers' and developers' reactions to exploits.
Older proof-of-work networks like Litecoin and Bitcoin face challenges with independent mining pools choosing when to upgrade, creating a window of vulnerability when a security patch needs to be applied universally before an attacker can exploit the gap. As of Sunday morning, the Litecoin Foundation had not publicly addressed the GitHub timeline, and the amount of LTC pegged out during the invalid block window, along with the value of any swaps completed before the reorganization reversed them, remained undisclosed.