Sybil attack with IOTA?

Question

The solutions to attacks proposed by IOTA white paper seems unclear, in particular, in case of double-spending, it remains unclear what stops a computationally powerful adversary from conducting a double spending attack as follows:

Adversary can use its coin and wait until it receives the goods, then it can make a second transaction with the same coin and confirm it by making many small transaction, perhaps under multiple different accounts. Attacks of this type where adversary floods the systems with new accounts are sometimes called Sybil attacks.

While other consensus algorithms have a clear answer to this problem, e.g. in PoW blockchains the adversary should have more computational power than rest of the system. Similarly in proof of stake blockchains adversary should obtain majority of stake (currency). And permissioned consensus protocols simply restrict the adversary from adding new nodes to the system.

The tangle blog actually leaves the impression that double spending is theoretically possible, but just technically difficult to do in practice.

(1) Do you agree with this assertion?

(2) Does it mean that although it is difficult to do; but eventually it's feasible?

Answer 1

Iota requires PoW on individual transactions. An attacker could double spend but they would need more hashing power than the rest of the honest users.

The hashing power of the current tangle is fairly low hence the need for the protection of the Coo. Unlike other PoW systems the hashing is not used in a competitive manner by miners but by the users themselves. It does however require the activity of the tangle to be high for the natural resilience to arise.

The Foundation is also researching additional security measures that would give the same protection that the coordinator now gives but in a decentralize way.