2

I keep hearing people say that 0 confirmations are safe at small dollar amounts because it would take more money to do a double spend hack. At what value does it start to become unsafe to trust a 0 confirmation transaction?

5

The easiest way to do a double spend against someone who accepts zero-confirmation transactions is with a Finney attack. To perform a Finney attack, you must first mine a block and be willing to risk losing that block. So the answer is that if the value of the transaction is small relative to the risk of losing a block reward, you don't have to worry about the attack.

Using today's numbers: An attack with a one minute window has about a 10% chance of costing you a block. The block reward is 25 Bitcoins and a Bitcoin is around $600. So for amounts much less than $1,500, you don't need to worry about a double spend. Nobody's going to risk losing $15,000 to steal $1,500.

Note that this assumes you know how to accept zero confirmation transactions! You must watch at multiple points in the network and ensure the fee is adequate.

  • Why couldn't you just look at your wallet and see that there is an unconfirmed transaction pending? – Tyler Gillies Mar 5 '14 at 4:06
  • 2
    @TylerGillies Two reasons: 1) That transaction may have been sent just to you while a totally different transaction was sent to everyone else. 2) That transaction may have a very low fee relative to its priority that will keep it from confirming and giving the person hours to perhaps mine their own block with a different transaction in it. – David Schwartz Mar 5 '14 at 4:27
1

There is no hard and fast rule. It depends on who is trying to attack and how. But I'd say that for amounts of up to $30, 0-confirmation transactions are usually very safe. For larger amounts it depends on the exact situation. Such transactions are safer if the good offered is illiquid, if the transaction is done in person and if the sender is identified in some way.

0

There isn't necessarily a specific amount of money at which an 0/unconfirmed attack becomes feasible, because it doesn't cost any money (perhaps only the transaction fee, but that's negligible). It's just luck which of the concurring transactions will be included in the next block(s). Do not trust 0/unconfirmed transactions, never. I don't understand why people are so eager to risk their money... Bitcoin was not designed to support 0/unconfirmed transactions, that would undermine the whole idea of a blockchain that registers and secures transactions.

  • It was not designed for 0-confirmations. But it is still true that in practice, 0-confirmations low-value transactions are very safe. There's no need to go through a lot of trouble just to protect against a 0.01% chance of losing a few bucks. The blockchain still gives the overall synchronization of the system. – Meni Rosenfeld Mar 4 '14 at 18:18
  • I don't see where that 0.01% chance came from. Please clarify. – Jori Mar 4 '14 at 19:07
  • It's my estimate for the chance that I will be the victim of a double-spend when I receive a 0-confirmation payment of low value in person. This is empirically backed by the fact that there have been lots of such transactions, but no reports of double-spends AFAIK. – Meni Rosenfeld Mar 4 '14 at 21:45
0

I will echo everyone else's answers, there is no hard and fast rule. There are a number of things to take into consideration:

  • how much are you willing to risk?
  • How much do you trust the person you are trading with?
  • How much do they have to gain, from being fair to you?
  • How much chance at preparation have they had?
  • Do they have a reputation to lose?
  • How much are they trusting you?

If you are getting or sending BC, then consider that in a trade, one side MUST trust the other first; either you give them the money before they transfer the BC (in which case they can run off with it), or you give them the money after they transfer the BC (in which case, you can run off without paying them). This, of course, applies to pretty much everything you buy/sell. If you get a subscription to a newspaper, you are entrusting them with money before you get your month's worth of newspaper. If you buy petrol (gas) for your car, you get the petrol before you pay for it. If you buy a car, you will need to pay for it before the ownership is transferred. Goods and money, or services and money, are never transferred "simultaneously".

The best way to mitigate the risk is to make sure they can make more off you by playing fair. A newspaper can make more off you by giving you the newspaper after you've paid for it, because it means you will extend your subscription next month. On auction websites, a seller who doesn't deliver may be penalized by getting a poor reputation. Some of these may apply to BC, depending on the situation. If you want $500 worth of BC, it may be worth getting it in several small amounts - $25, then $100, then $350, paying for each when you get no confirmations, but not getting the next one until you get some confirmations (perhaps different days).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.