6

Everyone talks about preventing a double spend transaction, but how does one do one to yourself in order to better understand the steps involved by the attacker?

  • What is required to do a double spend? Two phones running the same btc wallet?
  • Do you send at the same exact time?
  • Is it random a double spend happens when sending to multiple addresses?
  • How do certain online services that don't wait for the 1st confirmation stay in business? Wouldn't every attacker want to scam that no-confirmation service?
  • What are some preventive measures a business can use to prevent a double spend aside from waiting for 1-confirmation.

1 Answer 1

9

How to Double Spend

You can double spend using Electrum quite easily. Even without duplicating your wallet, be it on the same or on 2 different machines. Btw.: Duplicating wallets is super easy with Electrum.

Just go to Tools → Preferences → Transactions and check View transaction before signing.

Close the settings, go to the "Send" tab, and enter the first address you want to pay to and the amount to want to send. Click "Send ...".

A window titled "Transaction" opens. Click the button "Sign". This will require you to enter your password to sign the transaction but doesn't already send it.

Note that on my screenshots, it says that the amount sent is 0. This is because Electrum noticed that I used addresses of that same wallet. It will still actually send the transactions out and one of them will (probably) happen but it tells you that you're not sending money to someone else. If you want this to be different, create a second Electrum wallet to send the money to. Don't double spend when paying others.

After pressing the button, the transaction ID is generated, the button "Sign" disappears, and the button "Broadcast" appears. Don't already click that button.

Instead, go back to the main window and enter the second address you want to send to. Leave the amount to send the same.

Because the coin selection (if you didn't change it in the mean time, of course ;-) ) and the amount remained the same, the same UTXOs are selected when you press "Send". You can verify this by making sure the inputs are the same. Sign this transaction, too.

You now have 2 transactions spending the same UTXOs:

Then, broadcast both transactions quickly after each other.

It doesn't matter whether the addresses you send to belong to the same or a different wallet.

Alternatively, you can duplicate your wallet by simply copying your wallet file (which by default is stored in ~/.electrum/wallets or restoring the wallet (even though you still have it) with your seed. Of course, using the same wallet on a different device is possible, too.

Do Double Spends Happen by Accident?

Wallets usually try to not spend the same UTXOs twice because when you're not playing with it, it only causes trouble.

If you're using the same wallet on your PC and your smartphone, of course, it can happen that you're spending the same UTXOs twice accidentally because the device you made the first transaction on didn't broadcast it immediately or the device you made the second transaction on didn't know about the first transaction when you made the second one.

How do Online Services Accepting Unconfirmed Transactions Stay in Business?

How do restaurants which serve food without the customers having paid that food first, stay in business would be a much better question.

If you buy something online, it's usually something that's delivered to your home or at least connected to an account of yours you plan on using. You have an interest of not defrauding the people or companies providing the services you use because you don't want to be sued for not paying for what you ordered or having an account of yours closed.

In the case of restaurants, it's merely that people usually feel a moral obligation to pay for what they consumed much more than fearing to get caught because the chance of the latter happening as rather small. Restaurants can't sue you because they don't know your name or your address and they can't close an account containing stuff that's valuable to you, either.

And besides, what's with all the online services accepting payments via direct debit? How do they know that you're even the owner of that account? They don't, they just hope for it. If there is an unconfirmed transactions to the address they asked you to pay to, they at least know that the payment was authorized by the person owning the funds it uses and can't get in trouble with other people and their banks.

Detecting Double Spending

Businesses can't avoid it because they don't have power over it happening. But they can detect it. They can simply not process an order if, within relatively short period of time, a second transaction spending the same funds as the one they received first appears, and only process the order when the transaction sending sufficient funds to them has 3 confirmations. If someone tried to defraud a business, letting them wait a bit more than they usually would is only fair. If it the double spending happened by accident, the consequences aren't bad anyways so no one is really harmed significantly.

2
  • Would you be able to provide screenshots of how its done in electrum? thanks. Dec 26, 2016 at 21:10
  • 2
    @duckx I screenshotted pretty much everything that can be screenshotted.
    – UTF-8
    Dec 26, 2016 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.