Litecoin Network Recovers from Denial-of-Service Attack and 13-Block Rewrite

On Friday and Saturday, a series of events unfolded on the Litecoin network, involving a 13-block chain reorganization that reversed approximately 32 minutes of network activity. This action was taken in response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that hadn't been updated.

The Litecoin Core v0.21.5.4 release has since been made available, containing crucial security updates. According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating normally. However, an analysis of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately addressed between March 19 and 26, roughly four weeks before the attack occurred. A separate denial-of-service vulnerability was patched on the morning of April 25, with both fixes being rolled into the release 0.21.5.4 the same afternoon, after the attack had begun.

The timeline of events has raised concerns among researchers, with some arguing that the exploit was not a zero-day attack, as the vulnerability was known and patched privately a month prior. This created a window of opportunity for attackers, who appeared to be aware of which miners were running the patched code and which were still vulnerable. The attack involved a pre-funded wallet, which was used to swap LTC for ETH on a decentralized exchange.

The denial-of-service attack and the MWEB bug were separate components, designed to take patched mining nodes offline and allow unpatched ones to form a chain that included invalid transactions. The network's ability to automatically handle the 13-block reorganization once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack. The incident highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades through chat groups and pushing patches network-wide in hours.

In contrast, older proof-of-work networks like Litecoin and bitcoin rely on independent mining pools choosing when to upgrade, which can create a window of vulnerability when a security patch needs to reach everyone before an attacker exploits the gap.