A Dust Attack Exposed a Structural Problem Kaspa's unspent transaction output (UTXO) model carries a fundamental vulnerability. Unlike old block data, which nodes can eventually discard throu
Kaspa's unspent transaction output (UTXO) model carries a fundamental vulnerability. Unlike old block data, which nodes can eventually discard through pruning, coin records stored in the UTXO set never expire. To prevent a UTXO bloat attack, KIP-9 was created and implemented, as dust prevention primarily kicks in when sending very small amounts or a high count of outputs, which significantly increases the transaction mass.
A real-world dust attack on the Kaspa network illustrated the stakes. An attacker flooded the chain with tiny coin fragments, each of which every full node on the network was required to store permanently. The event made clear that without a structural fix, ledger bloat could be weaponised cheaply and repeatedly. As Kaspa researcher Shai Wyborski noted in a post-attack analysis, "KIP-9 prevented many such transactions from being included, protecting the network from lasting storage damage and instead converting it to temporary congestion."
KIP-9 was created to regulate the growth rate of the UTXO set in both organic and adversarial settings, introducing a transaction cost function that limits state bloat attacks. Co-authored by Kaspa core developer @michaelsuttonil, the proposal charges every transaction on two separate scales: computation and storage. The network applies whichever charge is higher.
The storage charge is dynamic. The formula penalises transactions that create many small-value outputs, factoring in the number of outputs and the harmonic mean of their values. In plain terms, splitting coins into small, scattered outputs drives the fee up. Merging coins into fewer, larger ones brings the storage charge down to zero.
Under certain conditions, fees must be raised even when the network is not congested, to satisfy the KIP-9 mass constraints. The practical result is that ledger bloat becomes either slow or expensive. According to the KIP's own analysis, wasting 50 GB of node storage in a single day would require a budget of 125 million KAS. Achieving the same outcome with only 100,000 KAS would take an estimated 750 years.
The approach reflects a broader design philosophy in Kaspa: rather than banning dust outright, the network makes such transactions costly for a spammer in a way that does not affect most users, but does affect those attempting to abuse it.
SourcesKIP-9 Full Proposal, kaspanet/kips on GitHubDust Attack Post-Mortem by Shai Wyborski, MediumQuadratic Storage Mass and KIP-9, Kaspa Research Forum
