Late Friday and Saturday, the Litecoin network experienced a significant disruption due to a denial-of-service attack, leveraging a vulnerability in its Mimblewimble Extension Block protocol. This vulnerability allowed for the creation of invalid transactions that were temporarily validated by nodes that had not been updated.
However, the network's longest valid chain eventually corrected these transactions, rewinding approximately 32 minutes of network activity. The Litecoin Core v0.21.5.4 release has been made available, advising all users to upgrade due to important security updates. According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating normally.
Nevertheless, security researchers have raised concerns based on the timeline of events as indicated by the litecoin-project GitHub repository. The repository shows that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack occurred. A separate denial-of-service vulnerability was patched on April 25. Both fixes were included in the release 0.21.5.4 after the attack had begun.
The term 'zero-day' refers to a vulnerability that is unknown to defenders at the time of an attack. In this case, the consensus vulnerability was known and patched a month prior to the exploit but had not been publicly announced or mandated for all mining pools, creating a window of vulnerability.
This situation allowed attackers to target nodes that had not been updated. Concerns have been raised by various experts, including Alex Shevchenko, CTO of NEAR Foundation's Aurora project, who pointed out the potential for coordinated attacks on different components of the network.
Blockchain data revealed that the attacker had prefunded a wallet 38 hours before the exploit, intending to swap LTC for ETH on a decentralized exchange. The denial-of-service attack and the MWEB bug appear to have been separate components of the exploit, with the DoS designed to take patched mining nodes offline, allowing the unpatched ones to form a chain that included the invalid transactions. The automatic handling of the 13-block reorganization by the network, once the DoS stopped, suggests that enough hashrate was running updated code to eventually overpower the attack.
This incident highlights the differences in how various networks respond to exploits, with newer chains often able to coordinate upgrades more swiftly. In contrast, older proof-of-work networks like Litecoin and Bitcoin, which rely on independent mining pools, may face challenges in promptly implementing security patches.
As of the last update, the Litecoin Foundation had not publicly addressed the timeline of events as indicated by the GitHub repository, and details regarding the amount of LTC involved in the invalid block window and the value of any swaps completed before the reorganization have not been disclosed.