A zero-day vulnerability, which precipitated a DoS attack that disrupted major mining pools on the Litecoin network, has been patched in the latest Litecoin Core upgrade.

Roughly 32 minutes of network activity was disrupted due to a vulnerability in the Mimblewimble Extension Block (MWEB) protocol. The bug temporarily allowed invalid MWEB transactions to slip through nodes that were not updated, but these were corrected with a 13-block reorg that excludes the malicious transactions from the main chain.

As communicated by the Litecoin account on twitter, all valid transactions during the vulnerability period are unaffected and the zero-day bug is fully patched. At no point did the network go down.

All users, node runners and mining operators are advised to upgrade to Litecoin Core v0.21.5.4, per an official Litecoin developer blog.

Contrary to some erroneous reports circulating online, there was no rollback of any blocks, per Litecoin developer Loshan.

The consensus of the biggest mining nodes were that the 13 blocks should be orphaned as there was a MWEB tx that wasn’t following consensus rules.

The developer alluded to the normal process of consensus and reconciliation in the decentralised network.

The timeline of events shows that an exploited zero-day bug which produced invalid transactions was successfully corrected through decentralised consensus.

Unlike other networks (decentralised in name only), which handle issues with all the subtlety and grace of a sledgehammer, there was no bailout, manual override or admin key required to institute a patch.

The Litecoin network successfully passed a stress test and continues to produce blocks as normal, while serving as a benchmark of decentralisation in practice.


If you found this article useful, consider sharing it.