My service automatically accepts, processes and sends payments to its users. It connects to bitcoind through its JSON-RPC API and makes use of the
raw transactions interface.
What is going to happen in this case:
- The service receives 3 payments by 3 different users.
- All payments are included into the next block so they now have one confirmation.
- Upon one confirmation, the service forms a new TX that spends these 3 outputs. The appropriate fee is attached. The TX is now valid but unconfirmed.
- A few seconds later a double-spend attack in one of the TX's (now-spent) outputs comes in place.
As I find it hard to reproduce the scenario above, my question is:
- What is the best way for the service to detect this double-spending attack through the RPC API?
- Once it detects the double-spending and realizes that the TX will never get confirmed, can it re-spend the same outputs (not including the one that has been double-spent) right away in the case of a race-attack?