REVIEW 4 major objections 4 minor 28 references
Yotta: A Large-Scale Trustless Data Trading Scheme for Blockchain System
T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read Yotta claims 130x faster blockchain data trading with six properties
desk verdict Useful problem statement and a plausible combination of known pieces, but the security property fails on the protocol's own steps—the published key unlocks the IPFS address and the data is stored in the clear. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the five-step Yotta workflow that couples address encryption with zk-SNARK provenance proofs and smart-contract key release. Its work is to decouple data possession and quality verification from key delivery: the seller proves possession and quality without revealing the data, while the blockchain handles payment deterministically only when the key decrypts the encrypted address correctly. Recursive SNARKs are the mechanism that lets one buyer verify many sellers' proofs in a single step, which is what converts one-to-many trades into many-to-many scale. The named property list SQUATS is the paper's own contribution as the formal target any large-scale trading scheme should satisfy.
What would settle it
Upload a plaintext dataset to IPFS, run the Yotta protocol with the address encrypted and the key published to the smart contract, and see whether an outside party who knows only the content address can retrieve the file; if they can, the claimed Security property fails.
Extended reading notes
Core claim
On the paper's own terms, Yotta is a trustless batch data-trading scheme for Web 3.0. Each seller stores their secret dataset on IPFS and encrypts only the IPFS address with a private key $K_i$, producing ciphertext $C_i$; the seller also uses zk-SNARK, a zero-knowledge proof with constant-size, data-independent verification, to demonstrate that the dataset satisfies the buyer's evaluation function $F()$, that $C_i$ really encrypts the address with $K_i$, and that $H(K_i)$ matches a published hash. The buyer verifies these proofs before depositing payment in a smart contract, and the contract pays each seller only if their submitted key decrypts $C_i$ to a valid address. The authors state that because only one of the key or the data is ever exposed and the data address is privately shared, the scheme achieves security along with scalability, making it a foundation for many-to-many data trading that no prior scheme has provided.
Load-bearing premise
The security property rests on the unstated assumption that files stored on IPFS cannot be fetched by anyone who knows their content address, because Yotta encrypts only the address and later releases the decryption key publicly for payment.
Editorial extensions
If this is right
- If Yotta's claims hold, large-scale data markets can operate without a trusted escrow: buyers deposit in a smart contract and sellers are paid automatically for correct keys.
- Buyers can verify data quality before payment because zk-SNARK proofs bind the buyer's evaluation function to the content-addressed data stored on IPFS.
- The scheme's cost profile favors growth: the reported prototype goes from roughly 3x over DCDH at 10 users to 130x at 10,000 users, so gains increase with market size.
- Recursive SNARK aggregation means the buyer's verification cost stays sublinear in the number of sellers, making many-to-many batches practical.
- The SQUATS list gives later designs a concrete target to check against, potentially serving as a common benchmark for Web 3.0 data-trading proposals.
Reading between the lines
- If the IPFS access assumption is not guaranteed, Yotta's security property requires that the data payload itself be encrypted before upload; the paper only specifies encrypting the address, so a reader should not infer stronger confidentiality than the protocol text states.
- The 130x figure compares a purpose-built prototype against a DCDH-based scheme; in a real deployment with network latency, storage costs, and on-chain gas fees, the relative gain could deviate, though the scaling trend should persist.
- SQUATS could be applied as an evaluation checklist beyond Yotta, turning the paper's contribution from a single system into a standard that future schemes can be measured against.
- A natural testable extension is to replace IPFS with other decentralized storage or add quality functions like Shapley values; the protocol's address-encryption structure is agnostic to that choice, per the paper's extensibility discussion.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes Yotta, a blockchain-based batch data trading scheme combining IPFS, zk-SNARKs, and smart contracts. The authors introduce a set of six properties, SQUATS (Scalability, Quality, Usability, Autonomy, Transparency, Security), claim to be the first to formalize these requirements, and assert that Yotta satisfies all of them. A prototype simulation is reported to outperform a DCDH baseline by up to 130x at 10,000 sellers. The central claims are that Yotta is the first complete large-scale trustless data trading scheme and that it provides data security while supporting many-to-many transactions.
Significance. If the technical claims were correct, a batch data trading scheme with verifiable data quality and no trusted third party would be a meaningful contribution to blockchain-based data markets. The paper's five-step protocol is clearly presented, and the idea of using zk-SNARKs to bind a seller's data to an IPFS content hash and to the buyer's evaluation function is a sensible design goal. However, the paper provides no machine-checked proofs, no released code, no formal adversary model, and no reproducible experimental description. The central Security claim is contradicted by the protocol's own steps, and the performance evaluation is not independently checkable. For these reasons the claimed significance is not established.
major comments (4)
- [Section 3.3.1, Steps 1(2)-(4), with Section 3.4 (Security)] The protocol does not protect the data payload. Step 1(3) uploads S_i to IPFS, Step 1(4) encrypts only address_i under K_i, and Step 4 publishes K_i on the smart contract. Once K_i is public, any party can decrypt C_i = Enc(K_i, address_i), obtain the IPFS content hash, and retrieve the plaintext file from IPFS. The alternative reading, suggested by Section 3.5.1's 'Encrypted Data Storage: Sellers encrypt their data and store them on IPFS', is that S_i itself is encrypted; but then the protocol never distributes the payload-decryption key to the buyer, so the buyer cannot access the purchased data. In either reading the Security property stated in Section 3.4, which promises that 'only the encryption key K_i is visible on the blockchain, preventing any third party from accessing the actual data content', is false, and the central claim that Yotta satisfies all six SQUATS properties is unsupported.
- [Section 4 and Figure 2] The claimed up-to-130x speedup over the 'DCDH' baseline is not supported by any reproducible experimental description. The baseline is not defined or cited, no experimental setup or methodology is given, Figure 2 has no axis labels or units, and no error bars or repeated runs are reported. Since the baseline may itself implement the key-exchange approach criticized in Section 2.2, the comparison cannot validate scalability. The performance claim should be either removed or backed by a released prototype and a described baseline.
- [Section 3.3.1, Step 1(6), with Section 3.4 (Quality)] The central quality guarantee rests on a zk-SNARK statement that the paper never instantiates. No circuit, proving key, verification key, or prover-cost measurement is provided for the claimed statement that S_i satisfies the buyer's evaluation function F(), that the committed data matches the IPFS content hash, and that C_i is an encryption of the address under K_i. Without a concrete circuit and cost analysis, the Quality property and the paper's scalability argument of constant proof size and verification cost are assertions, not results.
- [Section 3.4 and Section 1] The SQUATS properties are introduced and evaluated by the same paper; the statement that Yotta 'satisfies all the essential properties' is established with informal prose bullets rather than formal definitions or independent verification. In particular, Scalability, Usability, and Autonomy are never given measurable criteria. As a result the paper's novelty claim of being the 'first' to formalize these requirements and to provide a 'complete' scheme is self-referential and cannot be checked by a reader. To make the claim meaningful, each property needs a formal definition and a method to test it.
minor comments (4)
- [Figure 2 caption] The caption says 'DHDC' while the text and Section 4 refer to 'DCDH'; the two names should be reconciled.
- [Notation, Sections 3.3.1 and 3.3.5] The paper uses 'address_i' in Step 1(4) and Step 5 but 'IPFS content hash H_ipfs_i' in Step 1(3) and Step 2; it should clarify that the encrypted value is the IPFS content hash or define the relation between the two notions.
- [Page headers and footer] The running header contains 'Trovato et al.' and the footer contains 'Received 20 February 2007; revised 12 March 2009; accepted 5 June 2009', which are clearly template remnants and should be removed.
- [Reference [12]] Reference [12] is a generic editorial introduction and does not support the claim that data trading is a key focus of Web 3.0; a more specific citation would be appropriate.
Circularity Check
No significant circularity: Yotta's SQUATS checklist is self-authored but not tautological, the 130x comparison is an external (if underdescribed) baseline, and the security gap is a correctness flaw rather than a reduction to the paper's own inputs.
full rationale
I examined the claimed derivation chain: formalizing the SQUATS properties, designing Yotta to satisfy them, and evaluating against DCDH. The SQUATS properties are introduced by the same paper, but they are stated as general desiderata ('Scalability', 'Quality', 'Usability', 'Autonomy', 'Transparency', 'Security') and are not defined in terms of Yotta's specific mechanisms. Checking Yotta against them is design-to-spec, not a circular reduction in which the target conclusion is built into the premise. No fitted parameter is later renamed as a prediction: the reported up-to-130x result is a simulation comparison against a DCDH baseline; the baseline is underdescribed and the code is unreleased, which is a reproducibility problem, not circularity. I found no load-bearing self-citations: IPFS and zk-SNARK are cited to independent external references, and no uniqueness theorem from the authors is invoked to forbid alternatives. The apparent security contradiction (only the IPFS address is encrypted, yet the Security property claims third parties cannot access data content) is a serious correctness/design flaw, but it is an internal inconsistency rather than a circularity of the kind where the conclusion is equivalent to the inputs by construction. Accordingly, no specific circular step can be exhibited, and the circularity score is 0.
Assumptions & free parameters
assumptions (4)
- ad hoc to paper A zk-SNARK can be constructed that proves a seller possesses data S_i, that S_i satisfies the buyer's evaluation function F, that C_i encrypts the IPFS address under K_i, and that S_i matches the IPFS content hash, with practical prover cost.
- domain assumption Data stored on IPFS is confidential as long as its content address (CID) is not published, and publishing the decryption key does not expose the data.
- domain assumption Ethereum smart contracts can atomically verify submitted decryption keys against hashes and release or refund payments.
- standard math Recursive zk-SNARKs can aggregate many sellers' proofs into a single buyer-side verification step.
Cite this review
Pith. "Pith review of Yotta: A Large-Scale Trustless Data Trading Scheme for Blockchain System." pith.science (2026). https://pith.science/paper/MR5ZWHA3
@misc{pith2026250619368,
author = {Pith},
title = {Pith review of: Yotta: A Large-Scale Trustless Data Trading Scheme for Blockchain System},
year = {2026},
howpublished = {\url{https://pith.science/paper/MR5ZWHA3}},
note = {Machine review of arXiv:2506.19368}
}
read the original abstract
Data trading is one of the key focuses of Web 3.0. However, all the current methods that rely on blockchain-based smart contracts for data exchange cannot support large-scale data trading while ensuring data security, which falls short of fulfilling the spirit of Web 3.0. Even worse, there is currently a lack of discussion on the essential properties that large-scale data trading should satisfy. In this work, we are the first to formalize the property requirements for enabling data trading in Web 3.0. Based on these requirements, we are the first to propose Yotta, a complete batch data trading scheme for blockchain, which features a data trading design that leverages our innovative cryptographic workflow with IPFS and zk-SNARK. Our simulation results demonstrate that Yotta outperforms baseline approaches up to 130 times and exhibits excellent scalability to satisfy all the properties.
Figures
Reference graph
Works this paper leans on
-
[1]
Baoyi An, Mingjun Xiao, An Liu, Yun Xu, Xiangliang Zhang, and Qing Li. 2021. Secure crowdsensed data trading based on blockchain.IEEE Transactions on Mobile Computing22, 3 (2021), 1763–1778
work page 2021
-
[2]
Juan Benet. 2014. Ipfs-content addressed, versioned, p2p file system.arXiv preprint arXiv:1407.3561(2014)
arXiv 2014
-
[3]
Dan Boneh, Justin Drake, Ben Fisch, and Ariel Gabizon. 2020. Halo infinite: Recursive zk-SNARKs from any additive polynomial commitment scheme.Cryptology ePrint Archive(2020)
work page 2020
-
[4]
Sean Bowe, Alessandro Chiesa, Matthew Green, Ian Miers, Pratyush Mishra, and Howard Wu. 2020. Zexe: Enabling decentralized private computation. In2020 IEEE Symposium on Security and Privacy (SP). IEEE, 947–964
work page 2020
-
[5]
Binyi Chen, Benedikt Bünz, Dan Boneh, and Zhenfei Zhang. 2023. Hyperplonk: Plonk with linear-time prover and high-degree custom gates. In Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 499–530
work page 2023
-
[6]
Fei Chen, Jiahao Wang, Changkun Jiang, Tao Xiang, and Yuanyuan Yang. 2022. Blockchain based non-repudiable iot data trading: Simpler, faster, and cheaper. InIEEE INFOCOM 2022-IEEE Conference on Computer Communications. IEEE, 1958–1967
work page 2022
-
[7]
Weiqi Dai, Chunkai Dai, Kim-Kwang Raymond Choo, Changze Cui, Deiqing Zou, and Hai Jin. 2019. SDTE: A secure blockchain-based data trading ecosystem.IEEE Transactions on Information Forensics and Security15 (2019), 725–737
work page 2019
-
[8]
Xiangqian Dong, Bing Guo, Yan Shen, Xuliang Duan, YC Shen, and H Zhang. 2018. An efficient and secure decentralizing data sharing model. Chinese Journal of Computers41, 5 (2018), 1021–1036
work page 2018
Show all 28 references
-
[9]
Gregory Entin. 2023. Web3 Basics: The Future of a Decentralized Web. https://www.linkedin.com/pulse/web3-basics-future-decentralized-web- gregory-entin-vsvuc/ Accessed: 2025-04-28. Manuscript submitted to ACM Yotta: A Large-Scale Trustless Data Trading Scheme for Blockchain System 9
2023
-
[10]
Ariel Gabizon, Zachary J Williamson, and Oana Ciobotaru. 2019. Plonk: Permutations over lagrange-bases for oecumenical noninteractive arguments of knowledge.Cryptology ePrint Archive(2019)
2019
-
[11]
IDC. 2018. The Digitization of the World: From Edge to Core. https://www.seagate.com/files/www-content/our-story/trends/files/idc-seagate- dataage-whitepaper.pdf Accessed: 2025-04-28
2018
-
[12]
Ali Jadbabaie. 2014. IEEE Transactions on Network Science and Engineering.IEEE Transactions on Network Science and Engineering1, 01 (2014), 2–9
2014
-
[13]
Taeho Jung, Xiang-Yang Li, Wenchao Huang, Jianwei Qian, Linlin Chen, Junze Han, Jiahui Hou, and Cheng Su. 2017. Accounttrade: Accountable protocols for big data trading against dishonest consumers. InIEEE INFOCOM 2017-IEEE Conference on Computer Communications. IEEE, 1–9
2017
-
[14]
Taeho Jung, Xiang-Yang Li, Wenchao Huang, Zhongying Qiao, Jianwei Qian, Linlin Chen, Junze Han, and Jiahui Hou. 2018. Accounttrade: Accountability against dishonest big data buyers and sellers.IEEE Transactions on Information Forensics and Security14, 1 (2018), 223–234
2018
-
[15]
David Krause. 2024. Web3 and the Decentralized Future: Exploring Data Ownership, Privacy, and Blockchain Infrastructure.Privacy, and Blockchain Infrastructure (December 19, 2024)(2024)
2024
-
[16]
Chunlin Li, SongYu Liang, Jing Zhang, Qiao-e Wang, and Youlong Luo. 2022. Blockchain-based data trading in edge-cloud computing environment. Information Processing & Management59, 1 (2022), 102786
2022
-
[17]
Tianyi Liu, Tiancheng Xie, Jiaheng Zhang, Dawn Song, and Yupeng Zhang. 2024. Pianist: Scalable zkrollups via fully distributed zero-knowledge proofs. In2024 IEEE Symposium on Security and Privacy (SP). IEEE, 1777–1793
2024
-
[18]
Tianyi Liu, Xiang Xie, and Yupeng Zhang. 2021. zkCNN: Zero knowledge proofs for convolutional neural network predictions and accuracy. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 2968–2985
2021
-
[19]
Mozilla Foundation. 2024. Internet Health Report. https://foundation.mozilla.org/en/insights/internet-health-report Accessed: 2025-04-28
2024
-
[20]
Satoshi Nakamoto. 2008. Bitcoin: A peer-to-peer electronic cash system. (2008)
2008
-
[21]
Michael Rosenberg, Jacob White, Christina Garman, and Ian Miers. 2023. zk-creds: Flexible anonymous credentials from zksnarks and existing identity infrastructure. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 790–808
2023
-
[22]
Unknown Speaker. 2025. Web3 & Decentralization. Talk at Bratislava OpenCamp 2025. https://pretalx.opencamp.sk/bratislava-opencamp- 2025/talk/A8EJ8V/ Accessed: 2025-04-28
2025
-
[23]
Ikbal Taleb, Mohamed Adel Serhani, and Rachida Dssouli. 2018. Big data quality assessment model for unstructured data. In2018 International Conference on Innovations in Information Technology (IIT). IEEE, 69–74
2018
-
[24]
Gavin Wood et al. 2014. Ethereum: A secure decentralised generalised transaction ledger.Ethereum project yellow paper151, 2014 (2014), 1–32
2014
-
[25]
Li Yue, Huang Junqin, Qin Shengzhi, and Wang Ruijin. 2017. Big data model of security sharing based on blockchain. In2017 3rd International Conference on Big Data Computing and Communications (BIGCOM). IEEE, 117–121
2017
-
[26]
Shuli Zheng, Lixuan Pan, Donghui Hu, Meng Li, and Yuqi Fan. 2020. A blockchain-based trading platform for big data. InIEEE INFOCOM 2020-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 991–996
2020
-
[27]
Zibin Zheng, Shaoan Xie, Hongning Dai, Xiangping Chen, and Huaimin Wang. 2017. An overview of blockchain technology: Architecture, consensus, and future trends. In2017 IEEE international congress on big data (BigData congress). Ieee, 557–564
2017
-
[28]
Guy Zyskind, Oz Nathan, et al. 2015. Decentralizing privacy: Using blockchain to protect personal data. In2015 IEEE security and privacy workshops. IEEE, 180–184. Received 20 February 2007; revised 12 March 2009; accepted 5 June 2009 Manuscript submitted to ACM
2015
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.