Spending own generated unconfirmed change in the v.0.9.0 era

Question

Reading about spending own generated unconfirmed change some time ago I stumbled upon this reddit thread that convinced me that doing so is a really bad idea and could prove catastrophic for any business that allows it.

Now in the bitcoin core 0.9.0 release notes there are some fixes regarding the infamous malleability issue (search for text: "Transaction malleability-related fixes").

My question is pretty straightforward:

• Is it now safe to spend unconfirmed change generated by my own txs, after the 0.9.0 upgrades?
• If not, what is considered to be a safe number of confirmations for this change before I can use it as an input for another tx?

Answer 1

It is basically never a good idea to be spending from an unconfirmed transaction, regardless of transaction malleability fixes or other improvements. Unconfirmed transactions are not final and thus you shouldn't be spending from them unless you are willing to take the risk that transactions in the unconfirmed transactions chain can become invalidated. Since a transaction malleability fix is not a consensus rule yet, transactions are still malleable (and can still be after segwit too) and can be vulnerable to transaction malleability attacks.

As with any other transaction, you should only spend from it after it has at least 1 confirmation.