On Friday and Saturday, a series of events unfolded that led to a 13-block rewinding of the Litecoin network, effectively reversing 32 minutes of network activity. This action was taken in response to a denial-of-service attack that capitalized on a vulnerability within the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to be temporarily validated. The Litecoin Core v0.21.5.4 update, which includes critical security patches, has been released, with all users advised to upgrade promptly. According to the Litecoin Foundation, the bug has been fully patched, and the network has returned to normal operation.
However, an examination of the litecoin-project GitHub repository reveals that the vulnerability was known and privately patched between March 19 and 26, more than four weeks before the attack occurred. This timeline raises questions about the exploit, as it indicates that the vulnerability was not a true zero-day attack, given that it was already identified and patched. The attack involved a combination of a consensus vulnerability and a denial-of-service vulnerability, the latter of which was patched on April 25. Both fixes were incorporated into the release 0.21.5.4 after the attack had commenced.
The sequence of events highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools have the autonomy to choose when to upgrade, potentially creating windows of vulnerability. In contrast to newer, more centralized networks that can rapidly coordinate and implement patches, these older networks are more susceptible to exploits due to the time lag in updating all nodes. The incident underscores the importance of prompt and transparent communication about security vulnerabilities and the need for coordinated action among network participants to mitigate such risks.