On Friday and Saturday, the Litecoin network experienced a denial-of-service attack that resulted in a 13-block chain reorganization, effectively rewinding 32 minutes of network activity. The attack exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to be processed by nodes that had not been updated. However, the network's longest valid chain eventually corrected these transactions.
The Litecoin Foundation has since released an updated version of the Litecoin Core software (v0.21.5.4), which includes important security patches. According to the foundation, the bug has been fully patched, and the network is now operating normally. Researchers have pointed out that the vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack occurred.
The timeline of events has raised questions about the handling of the exploit, with some arguing that the vulnerability was known and patched privately before the attack. The denial-of-service attack and the MWEB bug were separate components, with the DoS designed to take patched mining nodes offline so that the unpatched ones would form the chain that included the invalid transactions. The fact that the network automatically handled the 13-block reorganization once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack.
The incident highlights the differences in how various networks respond to exploits, with newer chains being able to coordinate upgrades quickly and older proof-of-work networks like Litecoin and bitcoin relying on independent mining pools to choose when to upgrade. The Litecoin Foundation has not publicly addressed the GitHub timeline as of Sunday morning, and the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization reversed them have not been disclosed.