Any stratum scrypt pool based on this code could be vulnerable.  So that could be LTC or any of those scrypt-based scam coins.

https://github.com/viperaus/stratum-mining/pull/4
Yet again, pooler saves the day for dozens of other scrypt pools.

I hope you other pools appreciate his work.  Please consider donating to him.  LTCPooLqTK1SANSNeTR63GbGwabTKEkuS7

Update: It turns out that bhunt discovered the fix at roughly the same time as pooler.  Donations to pooler's address will be split with bhunt.

One of the developers might have found the new vulnerability.  They are testing a fix now. Not identifying them so people won't bother them.  They need to get this right.

Not the same exploit.  Related.  It's possible the wemineltc fix only made it better, but wasn't precise enough.  There are other theories.

Note: Litecoin Dev Team lended some help on issue, but pool software is solely the responsibility of pool owners.  It seems that serraz has given time to help analyze this issue even though he doesn't use this pool software.

I suggest that some of the affected pool operators post in this thread to identify cheating IP addresses and payout addresses.

We are preparing a big announcement that should go out in a few days.  Good news.  It was a surprise to us.

We are getting close to public beta, hopefully in the next week or two if all goes well.  Still trying to decide on the wisdom of future parameters and fixing the unit tests.  Please follow the Google+ page as important dev news gets posted there first.

Here are commits to the internal test repo since the OP.  There were a few more after this screenshot.  The tree needs to be cleaned up in another rebase prior to source release to help make it more understandable.

In general, the launch of any new coin needs to be fair and widely distributed in to prevent monopolies and 51% attacks.  Thus prior to launch of a real coin, you seriously need to test a fakecoin with *multiple* mining pools.  LTC mining pools currently have no experience with merged mining, thus a fakecoin with a built-in death date would give them practice in preparing to handle a real merged mine coin later.

Litecoin Dev Team feels most new coins are harmful, but merged mining coins are less bad as they do not compete for hash power that secures the main network.  While the team should not give preferential treatment to any particular coin, we do give a little more attention to answering questions to the bigger donors to the fundraiser as they have demonstrated commitment to the long-term safety and stability of the LTC network.

Warren

No disputing that rates against BTC fluctuate.  The rate against USD seems to remain relatively stable for long periods of time, for reasons I have never understood.  In any case the relatively stable USD rate actually makes it more attractive to merchants.  And Bitpay-type payment processors make the volatility less important since the processor absorbs the rate risk and the merchant is paid the invoiced amount of USD.

But what does this have to do with the dev fundraiser?  Nothing.  The devs job is to fix technical issues and make the software more dependable.

You've made your agenda clear.  Please move on?

You are twisting my words.  I said above that exchanges have an interest in contributing to long-term development of the client to reduce the risk of massive theft.

The merchants have an interest to use only the currencies that are stable and predictable in behavior.  Litecoin seems to have remained mostly within a comfortable range of 1.5-3.5 minute confirmation times for the past few months.  By contrast, the recent scam coins are characterized by repeated examples of technical failure, confirmation stagnation and extreme exchange rate volatility.  Merchants have little interest in accepting a virtual currency that takes hours to confirm, where they need to update their client often because of changing rules, and where the exchange rate swings 400% within a day.

Miners do have a choice.  They can stick to one of the established coins with a relatively stable exchange rate and confirmation time, or attempt to take advantage of idiots willing to buy newly mined scam coins.  Or they can also stop if they think the power expense is more than the coin will ever be worth.

http://www.cryptocoincharts.info/period-charts.php?period=alltime&resolution=day&pair=ftc-btc&market=btc-e
Here's one of the typical pump-and-dump scam clone coins that steal money from people dumb enough to buy it during the initial mining bubble.  You will notice in this chart that the early miners made thousands of BTC with this pump-and-dump scheme, which triggered a massive increase in hashrate as more idiots piled on.  As soon as the difficulty was too high and the price had plummeted, the coin fully collapsed with not enough miners to sustain confirmations. The leadership of this scam then tried to lure back miners with the promise of BTC bounties, which helped them to push it along slowly toward a smaller difficulty drop introduced in a mandatory hardfork client update.  Even after the adjusted client they are again now stuck with falling hashrate, the scam now having fully run its course.

The miners don't care about the long-term safety of the network.  So it would make no difference for the scam coin to be based on 0.6.x or 0.8.x.

The original developers are severely lacking time due to their day jobs.  They are contributing their expertise to development when I need help, often in cases to understand why things were done a particular way a year ago.  Probably because they already have stake and they don't have time to lead the current effort they have largely* refused to accept the current donations.

LTC needs to be well maintained and with many supporting vendor integration tools if is to have any chance of long-term growth in its fundamental value.  People need to use it as an actual medium of exchange for commerce instead of the manic-depressive speculation vehicle it currently is.  In support of this goal, it seems logical for large holders of LTC to donate a small portion to a long-term development effort if they want the rest of their holdings to have a better chance of growing in value.  More important than the holders of LTC are the exchanges of LTC.  They are the ones currently making profits from LTC trade.  They have an interest in the network being better maintained and the client more stable, because if chain accidents happen they can potentially be defrauded of a significant amount of money by double-spending theft.

Warren

* Largely but not entirely refused.  pooler said he "won't refuse" a small portion, and in my opinion he deserves it, especially after things like spending hours of his time to figure out how many competing pools were being cheated.  Your comments to the contrary in #litecoin suggesting that the pool was stealing from its miners was offensive, especially when you are a competing pool operator that would gain from spreading FUD.  Yes, a single CPU miner could fake a 35MH/s GPU farm when the pool was failing to check the difficulty correctly and you have a modified mining client.  (I'm guessing it didn't even need to do scrypt.  I didn't look at those details myself.)

I wrote earlier explaining this issue.

http://www.reddit.com/r/litecoin/comments/1f0sz4/litecoin_core_development_fundraising/

Please, no need for spam bumps.  Bump it when people announce their donations.

I remind this thread that I, the lead developer of Litecoin-0.8.2, asked the moderator to unsticky this thread because it is unnecessary for it to be successful.

TradeFortress has a reasonable argument here.  This thread does not need to be stickied to be successful as Litecoin can win on its own merits.

https://docs.google.com/spreadsheet/pub?key=0AnlrnfU-U6E-dFVuUnlfZUlqek9JbzlNYjVENWp3ZlE&gid=0
Thanks to the community we are approaching 2,000 LTC in donations.

https://plus.google.com/104307324656397909502/posts
Please follow the Litecoin Project on Google+ for the latest news.  Important news about p2pool and LTC stratum pool security landed in the past day.

The "silver" thing is just marketing fluff.  The reality is Litecoin is #2.  I don't exactly know how it became #2, but I have one theory.  The one thing Litecoin does better than Bitcoin is keep storage and memory overhead low due to its strong anti-spam protections.  We are now working on modernizing the Litecoin client to match bitcoin-0.8.2, with lower fees and exciting changes coming in subsequent releases.


https://bitcointalk.org/index.php?topic=215773.0
Please see the Litecoin Core Development Fundraiser Thread.

https://forum.litecoin.net/index.php/topic,3000.0.html
Read this thread to learn how to combine your dust into larger coins with zero fee.  I don't recommend the "Dust Settler" that the guy is trying to sell in that thread as it is new and nobody audited it.

You may also want to wait until the new lower fee kicks in, which might be in a few weeks.  I will post soon the fee transition plan.

https://docs.google.com/spreadsheet/pub?key=0AnlrnfU-U6E-dFVuUnlfZUlqek9JbzlNYjVENWp3ZlE&gid=0
Hey folks! If you would like your name or your business name to receive credit for your sponsorship, please contact me directly with the tx hash and crypto signature of the sending address along with the name you want to be listed in this table.

neotrix, please check your private message and contact me directly.

Code will go public after:
1) bitcoin-0.8.2 final is released.
2) I fix a few more bugs.  Currently we have 17+ test failures and a few missing tests.
3) I do a clean rebase of all the patches on top of bitcoin-0.8.2, to erase all the aborted commits, making the code easier to understand and maintain in the future.
4) After public beta testing indicates that this isn't dangerous.for mainnet.
5) At that point the code will go on github for public code review.  People can submit pull requests and our team will review and comment your patches for merit.

Currently some of the top donors are in the QA team, heavily testing binary builds based on 0.8.2rc3.  It is especially important for the big pool owners to make sure their custom pool software is compatible with the new litecoind under simulated heavy load.