From reading online, the general sentiment to this seems to be "no". You need at least 1 confirmation to prevent a double spend attack.
But in Mastering Bitcoin, there's this note:
A common misconception about bitcoin transactions is that they must be "confirmed" by waiting 10 minutes for a new block, or up to 60 minutes for a full six confirmations. Although confirmations ensure the transaction has been accepted by the whole network, such a delay is unnecessary for small-value items such as a cup of coffee. A merchant may accept a valid small-value transaction with no confirmations, with no more risk than a credit card payment made without an ID or a signature, as merchants routinely accept today.
Is this correct? I'm running an e-commerce platform where sellers typically set item prices in the range $1-$5 and I'm debating whether to allow zero-confirmation payments.
I can understand the rationale for a cup of coffee but with virtual items online, an attacker could try to double spend on many cheap items simultaneously.
