One-way accumulators are built upon a (quasi)-commutative one-way function. With quasi-commutativity, I refer to the following property:
For $f : X \times Y \to X$, it is true that $f(f(x, y_1), y_2) = f(f(x, y_2), y_1)$.
Although accumulators seem like a very useful cryptographic building block, I don't see them often in practical applications (in fact I can only think of Zerocoin). I suspect that this is because the scheme has certain disadvantages.
I wonder what these disadvantages are (if this is indeed the reason): is the function $f$ weak in terms of eg. collision-resistance, is it not efficient enough...?
The accumulators that I know of (note: I don't really know a lot about them, so this doesn't say much), seem to be based on number-theory (unlike conventional hash functions). This makes them a lot slower.
For example, Wikipedia describes the following function:
One trivial example is how large composite numbers accumulate their prime factors, as it's currently impractical to factor the composite number, but relatively easy to find a product and therefore check if a specific prime is one of the factors. New members may be added or subtracted to the set of factors simply by multiplying or factoring out the number respectively. More practical accumulators use a quasi-commutative hash function where the size (number of bits) of the accumulator does not grow with the number of members.
As they mention, this is clearly not practical because of the size of the output values.
Another example I have seen is $f(x, y) = x^y \pmod n$ where $n = pq$ (with $p$ and $q$ both safe primes). Even though this doesn't have the problem of the Wikipedia example, it is still not very efficient (even though you can do the exponentiations using the square-and-multiply method).