Bitcoin Forum

Say, I send 10 BTC from my account (holding 20 BTC) ABC to a vendor's account XYZ. Right after that, I send 10 BTC from my account ABC to the same vendor's account XYZ (consider I'd like to buy 2 products). We now have transaction t1 and transaction t2, which seem identical.

Besides the practical point of creating 1 transaction holding 20 BTC from ABC to XYZ, can t1 and t2 occur in one (valid) block? If so, why doesn't the malicious vendor not re-submit t1 infinite times untill my account has been depleted?

As far as I know you have to initiate the transaction, it is not a pull request from your wallet but more of a push. So a vendor has no control over receiving the funds and cannot run the same blockchain transaction multiple times as you described. Some vendors will give you different addresses to send payment to in order to differentiate new transactions. There is such a thing as a double spend, which requires many confirmations to counteract, but that's not what you're talking about here.

Thanks! Though as a malicious vendor, can I not 'push' the transaction of my 'customer', by just copying the transaction and broadcast it to the network?

No because txs are unique (they cannot be copied in the way that you are thinking). A tx is not as simple as "pay X address Y amount".

If you make two payments of 10 BTC to one vendor they are not identical at all and only the owner of the wallet that has funds can release those funds (by creating the tx that does so).

Transactions do not work by balances, but rather inputs and outputs which have a certain amount.

If your first transaction spent from a 20BTC output as its input, then 10 BTC will go to one output which the vendor can spend from and 10 BTC to a change output that you can spend fun. Your second transaction would then spend from the change output. These two transactions are not identical, and identical transactions in bitcoin cannot exist because they are the same transaction and treated as such.

The two transactions can confirm in the same block but if they don't, the second must confirm after the first because it spends from the first transaction.

Rebroadcasting s transaction doesn't drain the balance of an address. It simply reminds the network that there is a transaction spending from some inputs to some outputs but the data is still the same so it is treated as one transaction.

When you spend coins, the blockchain knows exactly which coins you're spending and where they came from.

So when you send 10BTC, you're actually spending multiple deposits that were put into your wallet. 
1BTC + 1.5BTC + 2BTC, or however you received them, until it adds up to 10BTC.

Or if you had a deposit of 20BTC, when you send 10BTC it actually sends the entire 20BTC, half to where you're sending and the other half back to yourself.

Thanks for explaining, I get it :-)

That's why you're not actually sending the money to anyone in particular.  You're sending the transaction to all Bitcoin nodes.

Then anyone with the private key can spend what you sent.

Your wallet scans all transactions, sees that some of them go to your addresses, and tells you that you've received money. 

But actually you could be running multiple computers with the same wallet.dat, they would all say that they've received the same transactions.

To avoid this, multiple confirmations are required and this
minimizes the risk.