Disclaimer: I don’t own any IOTA, haven’t owned IOTA in the past, and don’t plan to own any IOTA in the future.

I created a poll a week ago asking my readers what cryptocurrency I should review next. IOTA received 40% of the votes and won by a wide margin. I’ve since spent several hours researching IOTA and compiling everything I’ve learned in this article. I hope you find it helpful.

Although IOTA is currently in consolidation, it has seen a tremendous run-up in price this month. From a price of $1.27 at the start of December, IOTA’s price went as high as $5.34. At the time of writing, it’s price is at $3.90. Rising up more than 500% in 2 weeks is no small feat and there must be something very impressive about this nascent platform. Through my research, I’ve found many great things about IOTA that certainly justifies the excitement around it, I’ve also found several red flags that any serious investor cannot ignore.

Background

IOTA was founded by David Sønstebø, Sergey Ivancheglo, Dominik Schiener, and Dr. Serguei Popov. It has a fixed maximum supply of 2,779,530,283,277,761 IOTA. IOTA’s unique data structure and consensus algorithm sets it apart from traditional blockchains while giving it very special and attractive properties. Whereas traditional blockchains consist of a globally consistent linked list of blocks, IOTA uses a DAG or directed acyclic graph. A DAG is a fancy term for a network of nodes. Each connection between two nodes is unidirectional and the connections are acyclic (i.e. you cannot start from one node, traverse the connections in the graph, and get back to the same node). The use of a DAG allows IOTA to have the almost “too-good-to-be-true” properties of unlimited scaling and zero-fee transactions.

Put together, the DAG and IOTA’s consensus algorithm is known as the Tangle.

Tangle in layman’s terms

In traditional blockchains, such as Bitcoin and Ethereum, transactions are agnostic to the consensus algorithm. Users broadcast transactions and miners package them into blocks to be added to the system through proof of work.

In the Tangle, the consensus algorithm is an intrinsic property of using the ledger. There is no separation of users and miners. Every user is a miner and every miner is a user. How does that work? Well every time a user wants to send a transaction in the Tangle, his/her wallet needs to validate two prior transactions. In other words, if you want to use the Tangle, you need to be a miner. Keep this in mind, this is a very important property of IOTA with both positive and negative implications.

As I mentioned above, the Tangle’s underlying data structure is a DAG. As such, the nodes of the DAG are transactions and the connections between two nodes represents a validation. For example, if transaction B connects to transaction A, transaction A validated transaction B.

In traditional blockchains, the confirmation time of a transaction depends on the blockchain’s average block time and the fee a user is willing to pay. In the Tangle, a transaction’s confirmation time depends on the usage of the network. With low usage, a transaction will take longer to get validated since there are fewer new transactions that will validate it. With high usage, a transaction will get validated faster since there are more new transactions.

Does IOTA have trustless security?

An important question anyone needs to ask for a cryptocurrency consensus algorithm is: “what mechanisms does the system have in place in order to protect itself from double spend attacks?” This is always a complex topic. In IOTA’s case, an in-depth explanation of its double spend resiliency can be found here. To quickly summarize, a double spend attack is prevented by relying on at least two thirds of the network being good actors that select only valid transactions to reference. Any short term inconsistencies in the tangle are quickly overcome by the collective weight of honest users referencing valid transactions.

However, there is a very important caveat here. Since there isn’t a separate “miner class” in IOTA and validation is done through the users of the network issuing transactions, IOTA needs to be heavily used in order to be secure. If there is a lull in transaction frequency, there is a lull in security. I elaborate on this further in the Red Flags section below but at a high level, because IOTA is a relatively new cryptocurrency with very low network usage, the IOTA Foundation has to run what is known as a Coordinator that dictates the network’s progress. This effectively centralizes the network and significantly reduces its value proposition as a cryptocurrency.

If IOTA is able to significantly increase its network usage and shed off its reliance on the Coordinator, it’ll become a truly decentralized network with trustless security. IOTA is very centralized as long as it continues to rely on the Coordinator.

Internet of Things

Because IOTA theoretically has unlimited scalability with zero-fee transactions, it’s particularly suitable for the Internet of Things (IoT) applications. Specifically, devices can trade exact amounts of resources, as well as store data from sensors and dataloggers cheaply, quickly, and securely on the network. This is great for IoT devices that often need to broadcast and receive large amounts of data.

IOTA is quantum proof

IOTA is quantum proof. This means that quantum computing cannot theoretically break IOTA’s public-key algorithm. However, this also introduces a dangerous quirk to the system for those unaware. In order to be quantum proof, IOTA uses something called the Winternitz OTS which reveals 50% of an address’s private key every time a transaction is sent from that address. As such, it is not advised to send IOTA from the same address multiple times. This is known as the “address reuse” mistake.

Unfortunately, this wasn’t made clear in the official IOTA wallet and many users have made the this mistake. I remember a Reddit post where the poster claimed to have lost $30,000 worth of IOTA and had no idea how it happened. Turns out s/he made the address reuse mistake. This was posted at the start of December, right before the price jumped from $1 to $5. Ouch.

Given that IOTA’s public addresses are meant to only be used once, the number of unsafe public addresses will grow at an exceedingly fast pace. Luckily, the space of all possible addresses is insanely large so there’s no need to worry about the number of safe addresses running out any time soon.

Flash channels

Apparently, IOTA has deployed to production its own version of the Lightning Network called Flash Channels. Flash Channels are a bi-directional off-Tangle payment channel to enable instantaneous, high-throughput transactions. If this is true, it is incredibly impressive as Bitcoin and Ethereum haven’t been able to deploy their own versions of off-chain payment channels (technically Ethereum has deployed μRaiden but it’s a stripped down version of a full off-chain payment channel solution).

The only problem is, I haven’t been able to see any real applications of IOTA’s Flash Channels. I’ve tried visiting IOTA’s demo site where they have blog posts containing paywalled content that needed to be unlocked through a flash channel payment. However, even though the UI indicated a channel will be opened typically within 15 seconds, I was not able to open a channel.

IOTA also had a flash channel integration with SatoshiPay but that announcement was made in September 24th and nothing new has been announced since. I wonder if IOTA and SatoshiPay’s integration has stalled.

IOTA Foundation

The IOTA Foundation presides over IOTA. It’s a German non-profit corporation that coordinates and funds the development of IOTA. As of November 2017, the Foundation has a fund consisting of 5% of the total IOTA supply that’s worth $100 million as of November 2017. The fund is used to promote the development of a technological ecosystem around IOTA.

The Foundation is led by the co-founders of IOTA: David Sønstebø, Sergey Ivancheglo, Dominik Schiener, and Dr. Serguei Popov.

Corporate interest in IOTA

SatoshiPay began exploring the replacement of Bitcoin with IOTA as the company’s settlement network in July 2017. This comes after Bitcoin’s fees and confirmation times have increased significantly due to an increase in adoption of the network. Bitcoin continues to experience significant congestion today. SatoshiPay’s efforts to integrate IOTA has stalled recently in favour of the Stellar network. The IOTA + SatoshiPay integration is stuck at phase 2 of 3 phases and it is unclear whether SatoshiPay will choose Stellar over IOTA.
In August 2017, the IOTA Foundation forged a partnership with REFUNITE, the world’s largest missing persons database, in order to use IOTA technology to help reunite families during and after conflicts.
In August 2017, Monster Cleaning Services, a London UK based company, announced that they are accepting IOTA as a payment.
In August 2017, Sopra Steria, a European information technology consultancy company with 40,000 employees, announced a partnership with IOTA to create a framework to optimize security between devices on the Internet of Things.
In November 2017, LATTICE80, a Singapore based Fintech hub and largest of its kind, cemented an agreement to open an IOTA innovation lab for the Internet of Things.
In November 2017, IOTA announced its Data Marketplace. It’s an ambitious project that aims to create a market where individuals and companies can buy and sell data. Suppliers can setup sensors connected to the Tangle that will feed data to the market. Buyers can then ingest this data from the market for a small fee paid to the seller. The project is currently undergoing a 2-month-long pilot phase with several corporations and institutions participating including: Accenture, Fujitsu, Bosch, farmforce, and the University of Oslo. Read more about the project here.

Data Marketplace

The Data Marketplace was made possible only because of the Tangle’s unique properties of unlimited scaling and zero-fee transactions. This allows IoT devices to continuously inject a large amount of data into the network quickly and cheaply, which creates a highly efficient market where the only supply-side cost is the electricity needed to run IOTA’s node software and to perform proof of work every time a transaction is issued.

Red flags

I’ve encountered several red flags in the IOTA project that cannot be ignored. The project promises a lot and presents the Tangle as this new revolutionary cryptocurrency paradigm that will phase out blockchain technology. However, as with many things in the cryptocurrency space, there is a disconnect between marketing and reality.

IOTA’s security and centralization problem

The Tangle only provides security guarantees if an attacker doesn’t have more than 33% of the hashpower of the network. The only problem is, this is incredibly easy to do on IOTA since it doesn’t have dedicated miners. Remember that validation in IOTA only happens when a user sends a transaction (a transaction can only be issued if it validates two previous transactions).

As such, an attacker will often find it very easy to muster up more than 33% of the network’s hashpower. This is especially true in times of low network usage. If there is a lull in the transactions being issued on the Tangle, there is a drop in the network’s total hashpower. This is not true for blockchains, which tends to maintain a very steady level of hashpower regardless of the number of transactions being issued.

IOTA’s team knows about this inherent security flaw and has created a special node called the Coordinator that only they could operate. The Coordinator’s stated main purpose is to “protect the network until it grows strong enough to sustain against a large scale attack from those who own GPUs”. It does so by issuing special transactions called Milestones that are expected to be treated as a source of truth by normal IOTA nodes. Any transactions referenced by Coordinator-issued Milestone transactions are considered valid.

The existence and necessity of a Coordinator makes IOTA incredibly centralized and demonstrates a fundamental security flaw of the network. The only way IOTA can dig itself out of this hole is to significantly increase network usage and this is where the Data Marketplace comes in. If the project is successful, there should be hundreds of thousands if not millions of data sensors issuing transactions on the Tangle to feed data into the market, which will significantly increase and stabilize network usage. If the project fizzles out, IOTA will need to rely on the Coordinator for its foreseeable future.

In order to support zero-fee transactions and unlimited scaling, IOTA tightly coupled users and miners. However, we’ve demonstrated that this is not a cure-all solution and it brings with it its own flaws.

Source: https://medium.com/@ercwl/iota-is-centralized-6289246e7b4d

Curl fiasco - disregarding cryptographic best practices and founders demonstrating a lack of integrity

The number one rule of cryptography is to not “roll your own crypto”. Cryptographic functions rely on a great deal of security and existing, well-used functions have gone through years of vetting and testing to ensure that they are on the cutting edge of security. By rolling your own function, you’re eschewing all of this, thus introducing significant risk of security vulnerabilities.

However, this is exactly what IOTA chose to do. They rolled their own custom hash function called Curl. Lo and behold, an MIT team led by Neha Nerula demonstrated significant vulnerabilities in Curl. They found that Curl produced hash collisions in a predictable way (different inputs hash to the same output) and the team was able to “find collisions using commodity hardware within just a few minutes, and forge signatures on IOTA payments”. The MIT team reported this to IOTA’s team and the bug was swiftly patched.

This would have been a minor hiccup in IOTA’s development had it not been for Sergey Ivancheglo’s (IOTA co-founder) incredibly weird response to the whole situation. He claimed that the security vulnerabilities in the Curl hash function was, in fact, deliberate. The vulnerability was inserted as a “copy protection” to prevent copycat projects and to allow the IOTA team to compromise those projects if they sprang up.

That is very sketchy and demonstrates a lack of integrity on the part of the co-founder. Introducing flaws to the system so that IOTA can kill competitors is completely against the spirit of both open source development and the cryptocurrency community.

The most puzzling aspect of the situation is the fact that the co-founders were willing to expose IOTA’s network to such a drastic flaw in the first place. People are transacting their hard earned money on the network and the developers thought it was wise to introduce a massive security flaw just so IOTA couldn’t be copied? That should enrage any user.

Source: https://hackernoon.com/why-i-find-iota-deeply-alarming-934f1908194b

IOTA Data Marketplace PR fiasco

When IOTA released its launch marketing for the Data Marketplace project, there was a widely disseminated article by a third party publisher that claimed that Microsoft was “partnering” with the IOTA Foundation in building this project.

However, this turned out to be objectively false and IOTA was simply using Microsoft’s Azure platform to host the Data Marketplace. In essence, IOTA was a customer of Microsoft instead of a partner.

What was surprising was the IOTA team’s silence around the matter for the first few days that the article was out. During that time, IOTA’s price pumped from $1 to $5. It was not until a new article came out alleging that no such partnership existed did the IOTA team respond and confirm the allegation. The IOTA team’s delayed response in squashing the rumours is questionable and negligent.

The use of a balanced ternary numeral system is questionable

IOTA’s codebase uses a balanced ternary numeral system. So instead of having only 0’s and 1’s like binary, balanced ternary has -1’s, 0’s, and 1’s. IOTA’s developers defend this decision by stating that ternary processors are theoretically more efficient than binary processors and that certain mathematical constructs are more cleanly represented in balanced ternary.

However, the only problem is almost all modern hardware runs on binary systems. You’ll be hard pressed to find one balanced ternary processor anywhere. This means that all of IOTA’s internal ternary notation needs to be encapsulated in binary, resulting in significant storage and computational overhead.

Although this is clearly a questionable technical decision, as long as everything works without any drastic performance issues, the balanced ternary system is actually not that bad.

Source: https://hackernoon.com/why-i-find-iota-deeply-alarming-934f1908194b

Summary

IOTA is an ambitious and technically impressive project. It’s promise of unlimited scaling and zero-fee transactions is particularly enticing, especially for Bitcoin users that are currently seeing transaction confirmation times and fees sky rocket. However, it is not without its shortcomings. The network is definitely not secure in its current level of adoption and needs to be centralized to keep it afloat. The Data Marketplace project is a great initiative that not only brings tremendous utility to the network but also decentralizes it. However, it is important to keep in mind that if the project fails, IOTA will remain centralized for the foreseeable future. I also have some reservations on the maturity and leadership skills of the project’s co-founders. Besides these issues, I think IOTA is a very strong and exciting project.