What makes an unconfirmed tx 'suspicious'? (likely to be replaced or never confirm)

Question

When looking at Bitcoin unconfirmed transactions, I'm trying to distinguish between txs that are likely to confirm (whether that be in the first next block or in 2 hours) versus txs that are likely to be replaced, or never to confirm at all.

Obviously, txs with the opt-in RBF flag fall in the latter category.

But I guess there are other criteria, such as:

• having an extremely low fee, or even zero fee.
• Having lots of dust outputs.
• Depending on unconfirmed inputs.

Anything else I should take into consideration? What other factors could make a tx less likely to end up confirmed?

For example, besides dust output, do dust (i.e. many small) inputs make a tx less sure to confirm? (other than more inputs causing larger tx data, thus resulting in a lower fee when measured in satoshis per KB)

Answer 1

Replacing transactions without confirmation is relatively easy. I would tag every transaction without confirmation as "suspicious".

RBF is a policy and miners could also replace transaction that do not sign opt-in-RBF.

Best way to check if a 0-conf transactions will be mined soon:

• check nSequence number (only accept 0-conf if nSequence number is INT_MAX)
• check the transactions fee-rate and compare it with your estimated fee (requires a mempool/bitcoin-core)
• Calculate the risks: every 0-conf transaction can be replaced/double-spent! High value items should not be "dispatched" < 6 confirmations (IMO).