D13.co publishes Algorand fee proposals and post-mortems on MyAlgo attacks
The Fee Sustainability Debate on Algorand
Algorand’s fixed minimum transaction fee—currently 0.001 ALGO per transaction—has long been a point of contention. While the model ensures predictable costs for users, it creates a structural tension: as network usage grows, the revenue generated from fees may not scale proportionally to cover the infrastructure costs of running nodes. This misalignment becomes particularly acute for high-volume applications, such as micropayments or frequent smart-contract interactions, where even sub-cent fees can accumulate into prohibitive expenses. Conversely, raising the minimum fee risks pricing out these same use cases, potentially stalling adoption.
D13.co, an independent research site focused on Algorand, has published a series of opinion pieces examining this dilemma. The site’s proposals center on a priority fee market as an alternative to static fee increases. Under this model, users could optionally pay higher fees to secure earlier block inclusion, while the base fee remains low enough to preserve accessibility for low-value transactions. This approach leverages Algorand’s Pure Proof-of-Stake (PPoS) consensus, where block proposers are selected randomly and weighted by stake, ensuring that fee prioritization does not compromise decentralization or security. The mechanism would allow the network to dynamically adjust to demand spikes without imposing uniform cost increases on all users.
The MyAlgo Wallet Attacks: A Post-Mortem
In March 2023, a series of exploits targeted MyAlgo, a popular Algorand wallet, resulting in the theft of approximately $9.6 million. D13.co’s analysis identified five distinct waves of attacks, with the first occurring on February 20, 2023. The incidents exposed vulnerabilities in wallet security, particularly around private key management and transaction signing. While the attacks did not exploit flaws in Algorand’s layer-1 protocol, they underscored the risks of custodial or semi-custodial wallet solutions, where users entrust third parties with sensitive cryptographic material.
The post-mortem highlighted a critical tradeoff: convenience versus security. MyAlgo’s web-based interface offered a user-friendly experience but required users to input private keys into a browser environment, making them susceptible to phishing or malware. The practical mitigation is architectural: keeping private keys out of reach of page content entirely, via hardware wallets or non-custodial mobile wallets that isolate signing from the browser.
Technical Contributions and Smart-Contract Audits
Beyond theoretical proposals, D13.co has contributed practical tools and audits to the Algorand ecosystem. The site’s author discovered and disclosed vulnerabilities in several high-profile smart contracts, including those powering the Updog and FAME DAO platforms. These audits revealed flaws in governance token staking mechanisms and asset control logic, where malicious actors could exploit transaction sequencing or parameter manipulation to drain funds. The findings were responsibly disclosed — and, as the author recounts, he then demonstrated the exploits against the vulnerable contracts himself.
D13.co also developed smart contracts for EXA.market, an Algorand-based NFT marketplace. The contracts enabled a tiered rewards system, where users earned "Lootbox" NFTs for trading activity. These NFTs could be merged to unlock higher-tier rewards, a mechanism designed to incentivize platform engagement. The project demonstrated how Algorand Standard Assets (ASAs)—the network’s native tokenization framework—can be used to create complex, interactive economies without sacrificing performance. ASAs support fractional ownership, royalties, and custom metadata, making them suitable for both fungible and non-fungible use cases.
Infrastructure and Node Guidance
D13.co provides technical guides for running Algorand nodes, including a step-by-step tutorial for setting up a Voi participation node on Ubuntu 22.04. Voi is an independent layer-1 chain built on the Algorand Virtual Machine (AVM), so node operation and developer tooling carry over directly from Algorand. The guide emphasizes the importance of bare-metal configurations for reducing latency, a critical factor for applications requiring near-instant finality. Algorand’s consensus mechanism, which achieves finality in under 3 seconds on average, relies on low-latency communication between nodes to maintain performance.
The site also addresses the resource demands of running a node, noting that while Algorand’s lightweight consensus reduces hardware requirements compared to proof-of-work chains, it still necessitates reliable infrastructure. This is particularly relevant for participation nodes, which must remain online to contribute to consensus and earn rewards. D13.co’s recommendations align with Algorand’s broader push toward decentralization, where a diverse set of node operators strengthens network resilience.
Conflicts of Interest and Critical Scrutiny
While D13.co positions itself as an independent research outlet, its work is not without potential biases. The site’s author has disclosed personal involvement in certain projects, such as assigning the asset ID for Ora, an Algorand-based oracle service. This relationship raises questions about objectivity, particularly in analyses of Ora’s economic model or mining practices. For instance, D13.co’s review of Ora’s halving event included recommendations to reduce its negative externalities on Algorand’s infrastructure, but the author’s prior role in the project may have influenced the framing or conclusions.
Similarly, the site’s partnership with EXA.market—where D13.co was commissioned to develop smart contracts—introduces a financial incentive that could color its coverage of the platform. While the collaboration itself is not inherently problematic, it underscores the need for readers to approach D13.co’s work with a critical eye, particularly when evaluating projects where the author has a direct stake.
Why This Matters for Algorand’s Future
D13.co’s research touches on two existential challenges for Algorand: economic sustainability and security. The fee debate is not merely academic; it has real-world implications for the network’s competitiveness. Ethereum’s gas fee model, for example, has led to congestion and high costs during periods of peak demand, pushing users toward layer-2 solutions. Algorand’s sub-cent fees and sub-3-second finality are key differentiators, but they must be balanced against the need to fund infrastructure and validator rewards.
The MyAlgo attacks, meanwhile, serve as a cautionary tale about the risks of centralization in wallet design. Algorand’s architecture—with its focus on atomic transfers, smart signatures, and state proofs—provides the tools to build more secure alternatives. However, translating these capabilities into user-friendly solutions remains an ongoing challenge. D13.co’s post-mortems and audits help bridge this gap by identifying vulnerabilities and proposing fixes, but the broader ecosystem must prioritize security education and tooling to prevent similar incidents.
| Concept | Real-World Implication |
|---|---|
| Priority Fee Market | Allows users to pay higher fees for faster transaction inclusion while keeping base fees low for accessibility. |
| Pure Proof-of-Stake (PPoS) | Ensures fee prioritization does not compromise decentralization or security by randomly selecting block proposers based on stake. |
| State Proofs | Enable trustless verification of chain state, reducing reliance on full nodes and mitigating risks in wallet security. |
| Algorand Standard Assets (ASAs) | Support fractional ownership, royalties, and custom metadata, enabling complex economies without sacrificing performance. |
| Atomic Transfers | Allow multiple transactions to be executed simultaneously or not at all, reducing counterparty risk in decentralized applications. |
Source
Source: https://d13.co/