Bitcoin Forum

Hey!

I was wondering what the chances of a double spend is.

I am asking because I am building a website and cant decide between 0 and 1 confirmations.

Is it really that big of a risk if I just set it to 1 confirmation?

Thanks.

It really depends on what exactly you are selling on your website. If you are selling low value items and don't generally sell more then a few hundred dollars every 10 minutes or so then you should probably be fine with a 0/unconfirmed transaction as the risk of a double spend is low because it would probably cost more to attempt the double spend then the value of what could potentially be stolen from you.

If the value of what you are selling is much more, in the thousands or tens of thousands of dollars then you should wait for at least one confirmation as at this rate the cost of attempting a double spend would likely cost less then then value of what an attacker would be trying to steal

0 confirmation double spend is relative easy. To analyse the likelihood of a double spend you would have to analyse the incoming transactions. How big is the transaction (byte), how high is the priority, is a fee paid, is the fee high enough considering the priority/size, is one of the inputs unconfirmed, etc.
Unless you expect your customers to go elsewhere because they have to wait for a few minutes I would go with 1 confirmation.  To reverse a transaction that already has one confirmation is very difficult and would require a reorganisation of the blocks.

1 confirmation is usually good enough. However to be safe for sure you can keep it to 2 confirmations.

Thats what most of the sites do .

What you plan to sell?
As I gamble from time to time on luckyb.it and there I can gamble with unconfirmed amount.

Let's say I have 0.3BTC and I gamble all of them in 1 bet, I get the outcome in a matter of seconds and then I get the BTC in my account unconfirmed and I can bet again and again.... so if they go for 0 confirmation I guess you are safe to do it also... or you can contact them and ask them how they did it :)

Also don't be so naive to relay on what mtgox relied when they got "hacked" as it is very strange to me that everyone knew about that thing and only after mtgox publicly complained about it they got "hacked"!

 

Its actually more of a donation thing. Im not really selling anything.

You can have double-spending only if :
- the seller use a node server with no others nodes connected
- the buyer use ... the same node server
- the transaction is OK for both party with 0 confirmation

It's impossible.
In real life networking, you have 6-9 nodes to sprend the transaction ...

So its safe for me to accept 0 confirmations?

All reputable businesses will use 1. You don't truly have the coins until at least 1 confirmation.
Don't pull a Mt.Gox and leave yourself open with loose code. Protect yourself.

if you are not sending out any product or service instantly.. then it doesnt matter.. donations can be accepted anytime.. after all what is the sender needing to wait for after they send... nothing. so confirms or not the donator wont care/notice.

if you want to thank the donater, all you could do is just have a message that says
"it appears someone loves me and sent me a donation. many thanks, i love you back" .. as soon as it appears in the tx pool (unconfirmed)

Thanks.

If you are accepting donations then it really should not matter if someone double spends a transaction sent to you (nor would they have any reason to do so in the first place).

Wair for 1 to be safe.

Meuh6879 is missing some points, but since its for a donation 0 conf are fine.

I think you should wait for 1, unfortunately. There have been various accidents that can happen because of 0 conf.

You can make it as many confirmations as you want (6 is considered safe).

However, since it's online you can 0 confirmations for the user.  The frontend can accept the transaction once it's broadcasted (0 confirmations) while you can hold onto the product for as many confirmations as you'd like.  You can contact the user if the transaction is not legitimate.  Other than that, it's just waiting an hour to ship the product. 

If it's a digital good, you could still wait the hour or so to send the email (or in 10 min after 1 confirmation) to download.

What's the point of double spending a donation?

I use the blockchain.info site to check for at least 1-2 confirmations.

yes if :
- you use a "hardware wallet" ... not a virtual wallet (like blockchain.info or coinbase).
- you're connected to a mobile internet connexion and not the free wifi of the owner.

the 1st point is at minimum 6 nodes to emit the transaction.
the 2nd point is a basic and can view in the "monitor network" on android bitcoin wallet for example ... if you have only 1 node, you have a problem and your connexion can be compromised.

IDK. Maybe the creator of the project wants to forge donations on my site and withdraws?

So as I see, more safely will be use 1 confirmation when using BTC pamyment on sites?

This would not make any sense. If someone donates to your website then they are not receiving anything of value in return. Therefore it is impossible for you to wait for n confirmations because once you get as many confirmations you are not going to give the person potentially double spending anything of value

No, its a site that allows other people to accept donations in bitcoins.

Nice idea you have .... let us know when the site is ready ... I would like to try it

Will do. I think ill stick with 0 confirmations and add some sort of mechanism that verifies everything before withdrawing.

Uh.... ** Bitpay ** does zero-confirmation transactions. The dubious emphasis on confirmations is part of what kills the appeal of using bitcoin. This is not some scamcoin with a dead network. A simple code to do input analysis on a widely broadcast transaction and you are fine to accept 0 confirmations.

Which is fine for a company like bitpay that can have multiple nodes online to test how good the propagation of the TX is and keep rebroadcasting it, but a little site (no offense nahtnam) thats accepting donations this might be a little to much to ask for.


This sounds good. Confirm instantly (0 confirmations needed) and lets those receiving the donation wait a little longer (e.g. 6 confirmations). This gives those donating the good feeling instantly and those receiving the donation can probably wait an hour or two before they withdraw their money. Its FREE money I doubt anyone is going to get impatient about it.

That's very easy to work around.
Accept incoming donations with zero confirmations.
Only pay out to charities anything above 2 or more confirmations.

This is true! Just write in T&C that they can only withdraw after 6 confirmations! As this is free money for them they don't have the right to bitch about it! Only if they want to empty your wallet with double spend... so I guess 6 confirmations for withdrawing is perfect! As they can't say they have an emergency and they stay on the net to ask people for money! You call people for that and say I will pay back as soon as people will donate to me!

It would still be possible to double spend a 0/unconfirmed TX, especially if you control a large amount of hashpower and are either running a pool or are solo mining.

An easy solution to the OP's problem would be to process payments to charities in batches with the payment going out 1 day after payment is received

What are the donations going to?