However, at least the execution is dubious: not only was a major cryptographic vulnerability found a few months ago[0], it highlighted that

1. they made their own unproven crypto hash, which is a red flag, (in production, you should always prefer crypto that has survived many years of cryptanalysis) and

2. they were really not up-to-date on cryptanalysis techniques, as being vulnerable to differential cryptanalysis is, as Bruce Schneier puts it, "a rookie mistake".

Worse than that, they seem to rely on security through obscurity, purposefully making it hard to analyse their systems by making it base 3 (instead of the obvious base 2 that all of practical computer science relies on).

Finally, their justification for the coordinator is also a red flag[1].

[0] https://medium.com/@neha/cryptographic-vulnerabilities-in-io...

[1] https://medium.com/@ercwl/iota-is-centralized-6289246e7b4d

Regarding crypto, you can read their response & reasoning here: https://blog.iota.org/curl-disclosure-beyond-the-headline-18...

"The replacement Kerl hash function is unmodified KECCAK-384 that only converts its input and output from/to 243 trits to 48 bytes using basic two’s complement. KECCAK-384 is well vetted and researched."

> "The replacement Kerl hash function is unmodified KECCAK-384 that only converts its input and output from/to 243 trits to 48 bytes using basic two’s complement. KECCAK-384 is well vetted and researched."

"Replacement" really does mean replacement, i.e. what they substituted in after the researchers successfully attacked their original hash function. (The new one is called "Kerl" and the old one is called "Curl", which seems confusing.)

I'm not sure how asserting that the replacement is well-researched addresses the OP's point that their history of (a) rolling their own hash function, and (b) not adequately considering differential cryptanalysis, is a red flag. True, that specific vulnerability can now be considered fixed, which might not be clear from the OP's post - but it's still evidence of incompetence, which doesn't bode well for the quality of the rest of their design.

Curl is meant to be a lightweight crypto for IOT, a field of very active research. None of this is controversial to anyone that isn't looking for things to latch negativity onto.

This seems to contradict the researcher's own post [1]:

> We discovered a vulnerability in IOTA after reviewing their code on GitHub in July. We disclosed what we found to the IOTA team on July 14th, and have been in contact with them since then as we discovered new issues and exploits.

Finally, even if Curl is meant as a new, lightweight hash function, it was broken by differential cryptanalysis, not some novel, exotic attack vector. Sounds like it needs a lot of work before it's fit for purpose.

[1] https://medium.com/@neha/cryptographic-vulnerabilities-in-io...

https://blog.iota.org/curl-disclosure-beyond-the-headline-18...

This article also answers the wrong question. If the crytocurrency is not cryptographically secure all that stands between an attacker and a victim is a piece of malware or social engineering. The fact that the researchers didn't go all the way and document a specific attack that could be performed tomorrow does not mean that Curl was secure in practice.

Finally this continues to fail to address many salient points. Like why use trits? Why wasn't kekkac used from day one?

2. Bitcoin had no privileged nodes, nor does it now. All miners compete on the same terms. A central coordinator by definiton does not, or it wouldn’t be centralized.

[1] https://docs.google.com/document/d/1J8hehbnZWzcIUMQcxMiGbjz8...

I’m highly skeptical of this claim since there’s a cost to running any system. It seems more likely that they just made fees implicit rather than explicit (as in Bitcoin) but, regardless, someone needs to be paid to keep servers running.

Unless the cost of verifying transactions is zero, this just means that the cost is now measured in CPU cycles at the client. In the end, this may be higher than whatever you pay with Bitcoin, depending on how much work you need to do. This is what I mean by "making fees implicit" - there's still work to be done, but not putting a price on this work doesn't mean it's free.

Then there is a price; it's just measured in watt-hours of energy spent instead of denominated in cryptocurrency.