The whitepaper focuses mainly on attacks in which an attacker tries to double-spend. So the section about the splitting attack examines the case that an attacker tries to effectively create two forks of the tangle and spend tokens in both branches.

However, what about an attacker who only wants to sabotage the network and who does not care about whether the network will eventually agree which of the conflicting transactions he issued is to be accepted or if both of them are abandoned (also mentioned in the whitepaper)? The goal of the attacker is not to double-spend but to keep the tangle busy resolving a large number of conflicts.

In a large tangle (and it is supposed to be huge!) conflicting transactions slipped into the network at different places spread widely before they are recognized as such by a majority of the nodes. The whitepaper (on page 25) explicitly states "It is worth noting that the attacker’s task [i.e. trying to balance the two forks to maintain the split] is very difficult because of network synchronization issues: They may not be aware of a large number of recently issued transactions". Unfortunately this seems to be true for every well-behaving node in the network as well.

A node validating transactions cannot know for sure if conflicting transactions were issued somewhere else in the network so the attacker's transactions will inevitably be confirmed frequently before being dismissed.

The whitepaper argues that such conflicts will be resolved eventually. Maybe this is the case, but resolving the conflict can mean a significant effort and delay. Many transactions would have to be reissued because they built on the part of the tangle that ends up abandoned. For someone issuing an urgent transaction it would be risky in a sense to confirm two tip transactions because they are more likely to turn out contradicting others. On the other hand, the attacker needs only minimal effort but forces the network to do a lot of unnecessary work.

The only option I see is to isolate the malicious nodes issuing the conflicting transactions from the network through the transaction routing protocol. However, I don't understand how that would be possible given the network topology. Maybe I'm missing a simple solution. Are there any resources on this kind of attack and appropriate countermeasures?

  • "This means that approximately half of the transactions confirming the attacker's transaction will end up being invalid themselves." - This doesn't look correct. Do you assume that transactions are referenced randomly and uniformly? Do you ignore existence of the strong positive feedback which leads to an unstable equilibrium? Dec 7, 2017 at 19:59
  • @Come-from-Beyond can you expand that comment and maybe rephrase it as answer? It looks to me you have some key points to that question there but I cannot really answer it for myself with it. And the current answer of Helmar is little too far off for my understanding.
    – Jey DWork
    Dec 13, 2017 at 19:43
  • @Come-from-Beyond thanks for your comment. The sentence was in fact not precise, because the transactions don't become invalid, they just have to be reattached. "half the transactions" was also misleading because after the resolution of the conflict it is a minority (still "many transactions" as stated later). I removed the sentence. However, the question remains: How do we know the network converges fast enough on the winning branch to render such attacks (which cost the attacker almost nothing) ineffective?
    – lex82
    Dec 14, 2017 at 7:54
  • 1
    @Come-from-Beyond well, at least you don't seem to have a problem with commenting on those questions. Although you didn't provide an answer, you helped me me a lot with regard to my overall goal: deciding whether to further concern myself with IOTA. I'd rather not spend my time on your "bold claims".
    – lex82
    Dec 14, 2017 at 16:36
  • 2
    Charming as ever... So by reading that I meanwhile also got a better understanding and what remains is the (partially new) question "What is the actual cost of a splitting attack without double spending but only destructive intentions?". A lecture in that would be more appreciated than in arguing guidelines (and also I see your point especially due to the topic, this is a Question & Answering and not Arguing platform ;-)
    – Jey DWork
    Dec 15, 2017 at 1:01

1 Answer 1


You're tackling a few points there. The first remark that I have is right in the title. A splitting attack is not performed regularly. It's more precisely described as one sustained attack. A splitting attack's goal is to split the tangle in two parts that they can identify and spend on both.

Then, the attacker hopes that roughly half of the network would contribute to each ranch so that they would be able to “compensate” for random fluctuations, even with a relatively small amount of personal computing power. If this technique works, the attacker would be able to spend the same funds on the two branches.

[...] To defend against such an attack, one needs to use a [...] rule that makes it too hard to maintain the balance between the two branches. (IOTA WP 1.3, page 24)

Let's have a second look at the potential gain of the attacker—it determines how much effort someone might be willing to spend after all. They want to spend the same funds twice. The amount of those original funds is not relevant to the attack since the amount per transaction is not limited. It's however the maximum gain of the attacker. The plan has to be to sell that amount (i.e. get a non-IOTA currency for it). To do that you'll have to reach a certain approval on your transaction selling the IOTAs. That amount of transactions based on your selling the IOTAs has to be performed by the network before the splitting attack founders.

When it founders the attacker will either want the half of the network to win where they didn't spend anything or they'll spend on both halves. The latter is more likely since it would be even harder to make sure onto which half the network falls.

Thus, the technical goal of the attacker is to keep the splitting attack long enough alive to have his sales confirmed. Remember that confirmation is based on transactions that are based on your transaction.

Goal of the splitting attack: Split long enough to have two transactions confirmed.

The defense against that is listed in the whitepaper as well, "make it too hard to maintain the balance between the two branches."

To maintain such a balance an attacker would have to counterbalance the two parts of the network in order to bring all honest nodes to pick transactions from both sides with a chance close enough to 50% that neither of the sides win. In order to do that an attacker would need a remarkable knowledge of the network—and potentially the future—since a large bunch of issued transactions on one side could easily tip the whole thing to one side.

That makes it obvious that this kind of attack gets naturally harder and harder the more active the network is. A network that's more active has more nodes that would have to pick almost equally on both sides and there are more transactions which could be issued based one side without the attacker having the possibility to counterbalance them—both making it harder to maintain the split.

Considering the decentralized nature of the tangle it is quite hard to maintain such a balance. Especially if you factor in peaks in transactions (it's a high-load attack-vector after all), network latencies and other issues that make it unlikely that the attacker has enough knowledge to issue transactions that would keep the split-balance.

  • 4
    Thank you for your help. However, unfortunately, your answer misses the point. In the scenario I proposed, the attacker does neither try to keep the balance of the split nor does he or she spend money twice. The goal is to bring the network down. I edited the question to make it more clear.
    – lex82
    Dec 6, 2017 at 15:46
  • @lex82 I don't get it. A split is the result of two transactions which don't agree with each other. If there is no coordination to keep the two ends balanced there's simply no split because one of the two quickly wins. I get now that you are aiming at another motive but the underlying technology didn't change.
    – Helmar
    Dec 6, 2017 at 17:53
  • 1
    The attacker initiates the split with two conflicting transactions being injected in different parts of the network. Since nodes have only local information at first, they start confirming the transactions until they realize the split. Many transactions will be added on top of them and will partially become invalid. Maintaining the split for a long time is hard. Creating a split that causes trouble is easy.
    – lex82
    Dec 6, 2017 at 22:14
  • @lex82 how do you even identify different parts of the network. The topology is basically unknown to the attacker. Even with thousands of nodes most nodes will be relatively close, hop wise. So at most a dozen or transactions (or bundles) before the network converges and your split is gone. That doesn't sound troublesome to me.
    – Helmar
    Dec 7, 2017 at 6:18
  • 4
    It appears to me that this is wishful thinking. The WP explicitly states that maintaining the split is very difficult for the attacker because of incomplete information about new transactions. The same is true for honest nodes with regard to resolving the split. Some splits will resolve fast. Others could grow substantially. Even if only a dozen transactions build on the losing fork, the attacker issues 2 transactions and invalidates 12 that will have to be issued again.
    – lex82
    Dec 7, 2017 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.