Bitcoin Forum

New to Bitcoin, and apologies if this question has been answered before in another way.

I have a very basic idea on what confirmations are (the depth of the transaction, how many blocks have been completed since etc).

What I do not get is why some places would need 6 or more confirmations while others are pretty happy with 1 or 2. Isn't the blockchain and mining invented in such a way that once a block has been completed that it's 100% secure and perfectly confirmed?  In other words that x confirmation(s) should in theory always be as good as y confirmation(s), provided neither x or y = 0?  What makes something like 1 or 2 confirmations so much "less secure" than 6 or more? Can something go wrong after 3 or 4 that 6 is really needed?
Has anyone ever lost coins because they didn't wait for enough confirmations?
Thank you.

6 confirmations is pretty outdated at this point. If we're talking about being 100% sure that your millions went through then yes, you want 6 confirmations, but if you're waiting for your 0.01BTC to be confirmed 1 or 2 is really all you need to be sure the transaction will be picked up by miners. It's all about risk, and smaller valued transactions don't really need anything more than 1 confirmation. Some websites will require 6, but a lot only need 1 (or anything in between).

Read more here:

https://en.bitcoin.it/wiki/Confirmation (https://en.bitcoin.it/wiki/Confirmation)

Some of the sites have started reducing the confirmations . Many of them are okay with 3 confirmations.

your question does not belong here, move it to Development & Technical Discussion use the button at bottom left

it is because of the risks of Double Spending (https://en.bitcoin.it/wiki/Double_spending) so the suggestion (https://en.bitcoin.it/wiki/Confirmation) is that a transaction should not be considered as confirmed until it is a certain number of blocks deep. this number is usually 6.

From the developers guide (https://bitcoin.org/en/developer-guide#verifying-payment)
0 confirmations: The transaction has been broadcast but is still not included in any block. Zero confirmation transactions (unconfirmed transactions) should generally not be trusted without risk analysis. Although miners usually confirm the first transaction they receive, fraudsters may be able to manipulate the network into including their version of a transaction.

1 confirmation: The transaction is included in the latest block and double-spend risk decreases dramatically. Transactions which pay sufficient transaction fees need 10 minutes on average to receive one confirmation. However, the most recent block gets replaced fairly often by accident, so a double spend is still a real possibility.

2 confirmations: The most recent block was chained to the block which includes the transaction. As of March 2014, two block replacements were exceedingly rare, and a two block replacement attack was impractical without expensive mining equipment.

6 confirmations: The network has spent about an hour working to protect the transaction against double spends and the transaction is buried under six blocks. Even a reasonably lucky attacker would require a large percentage of the total network hashing power to replace six blocks. Although this number is somewhat arbitrary, software handling high-value transactions, or otherwise at risk for fraud, should wait for at least six confirmations before treating a payment as accepted.

---

bottom point.
if the transaction is small and the sender is trusted 1 confirmation is enough.

if the transaction is big or the sender is not-known 6+ confirmation is a better choice

That's is very complete, thanks your link it's also very usefull for me.  ;) Bookmark it.

Many sites also do need more confirmations for deposits. Make sure you get at least one confirmation for a person you trust and you know is not scamming you. For other cases make sure to wait for at least 4 confirmations, more is always good.

An attacker needs to generate a longer chain to be able to double spend.

Creating a chain 1 block longer than the current legit chain is easier than going back 4 blocks or 40 blocks.

For example, going back 40 blocks means that you to beat all of the computational power put into all of those 40 blocks.

I don't believe that any one has actually double spent 1 confirmation except for that time Bitcoin forked due to a bug in the code.

However when talking about the traditional 51% attack, I do not believe a 1 confirmation attack has ever been pulled off.

It's all about economics. The amount of computation power required to pull of a 1 confirmation attack is obviously huge and anyone trying it would have to have a good reason to do so.

Whilst no one is going to double spend 1 confirmation for a coffee, they might double spend for a $100 million transaction. Of course the real world plays apart here.

If two banks were transferring a single huge value transaction and one of the banks fired up a massive ASIC farm to double spend, the other bank in the real world will just sue and get their money back.

So it's really a very unlikely situation that there will be enough value in such a transaction that has no real world legal consequence that a double spend of 1 confirmation will occur.

However, a valid reason for a double spend attack would be by someone trying to ruin Bitcoins reputation.


Nothing is ever 100% secure, but 1 confirmations are very secure and 6 confirmations are even more secure....

It wasn't even too long ago some websites were fine with 0 confirmations but that's pretty rare if you can find it all now a days. As second post said, 6 confirmations is a bit old school but you're going to want a handful if you're sending big amounts. It doesn't make sense to require so many confirmations for a low amount of money and just ends up being a huge pain. I suppose it's easier to set one general rule for them rather than adjusting based on the amount being sent / received.

Exactly! I also believe that they just not updated their code to it for reasons of "laziness".

6 confirmations from github source reccomended. 2-3 are enough at this hashrate and centralization. Cause btc ihmo is way centralized by mining farms

1 confirmation takes alot of resources to rewrite. If you're an everyday user and there's on reason for someone to start attack on you, 1 confo is more than enough. Any more is overkill.

The only time you would really need more is if you're escrowing for many people, or are transferring millions.

For an everyday user, there will be no difference between 1 and 6 confirmations. But for someone who has reason to suspect an attack, or has alot of money at risk, they would go for 4-6 confirmations.

2 confirms and nothing can happen...

0 confirms = douple spend
1 confirm = revoke block
2 confirms = ??

Wrong. There is a chance that a 2 block chain will be orphaned. Maybe a miner found 2 blocks a little bit late, and managed to find the third one quickest, orphaning the 2 blocks before. The chance is extremely low, but is a risk to some. There also is the chance that a pool owner might discuss with an attacker, and only confirm blocks without their transactions inside for BTC. I'm not sure what the longest chain that has been orphaned is, but I'm guessing a 2 block orphan has happened before.

There were 2 significant events that caused large forks.

Other than those, I have seen a 2-block orphan happen 8 times since 2012. I have seen a 3-block orphan only 2 times. No 4 or 5-block orphans, but we did have a 6-block orphan happen once.

There was a soft fork in June last year. Some miners were SPV mining and were listening to other pools for new blocks. They started work as soon as they get the block info and did not validate whether the blocks follow the network rules. F2pool, the biggest pool at that time was doing SPV mining and when they received the block from the other pool, they did not realised that the block was a Version 2 instead of a Version 3 and they started working on it. They subsequently produced another version 2 block together with several other mining pools and it resulted in those with older Bitcoin Core versions and some SPV wallets accepting the invalid blocks. Even though it wasn't a huge issue and did not cause any known double spends, it was a rather serious event.

BitPay uses zero confirmation. They have their own algo to determine if a transaction looks unlikely to be double spent. I'm not sure but I think it looks like this:

1. Wait for transaction; see it. (they ask you to pay a particular address, so that's all they have to watch.)
2. Look at transaction; see if it has at least a minimum tx fee and inputs are already confirmed.
3. Wait for a few seconds; see if there are any other transactions using the same inputs (double spend)
4. If the above looks good, accept the transaction and credit the user or payer; give them their receipt or whatever.

According to transaction propagation statistics, on average, 5 seconds later your tx has been seen by 50% to 90% of nodes on the network. 10 seconds later 99% of nodes have seen your tx. Blocks take maybe a minute or two to be seen by 90% of nodes.

Even if there are 2 or 3 block orphans, that does not mean your particular transaction is being double-spent or an attempt on it. The only one who can do that is the one who has control of the private keys of the inputs in question. Your transaction or the transaction you are watching will likely be included in the any or all forks or orphans, or will be included in the next block.

I just stick to 1 confirmation. To me, that means a miner included it in that block, and other miners will probably include that particular one I am interested in in the next block if an orphan happens.

I recently constructed a rather large transaction with several inputs worth 50 BTC. Since I was the one doing it, I did not even bother to wait for a confirmation when I was combining all the inputs, I just did it one after the other. (No one is going to double spend my stuff, except me, right?) Turns out the whole thing (4 transactions all together) confirmed in about 20 minutes since I broadcast them.

thanks for shedding some light on this.
I knew that zero confirmation payments can work, but I never could wrap my head around how it would actually work.

-sf-

At a moment I exchanged 2.1 btc with a romanian trader having 0 confirmations, but i send from localbitcoins.

He was saying smth like from lb bitcoins are "send corectly". Never knew what that means.

Normally it takes 30 10-15 minutes for a confirmation, this is even a lot when you're in a hurry.

Just to add to previous replies, 6 confirmations are considered fully confirmed, I haven't come across any service that would require more than 6 confirmations

Great answers, thank you guys! :)

wait, I know BitPay, it's most secure and many famous companies worked with them. Also once I had experience to integrate their API on one company's website as payment system but I remember that there wasn't any similar things, transactions with zero confirmation. Can you link me the information about that on their website? I can't find it.

So what's about this thread, of course 6 confirmations wins here :D Many websites usually need 5-6 confirmation to make transaction, not more than 6. Also you are more secured with 6 transaction than 1 but it depends on how is payment options because some websites give you permission to use bitcoin deposited money once it is registered but you can't withdraw it if's not confirmed because we can remove transactions that has no more than 1-2 confirmation

It doesn't say it anywhere.

But think about it, when you go to pay with bitcoins, the payment thing with qr-code shows up. Then you pay and send your transaction. Count about 10 seconds and your payment is accepted and you are moved to the next part of whatever website you are on.

So, anywhere from 10 seconds after you broadcast your bitcoin transaction to about a minute. Maybe your tx would already have a confirmation, but most likely it does not.

This is very interesting, someone know for sure if Bitpay/Coinbase is taking responsibility on Double spend transactions and compensate the businesses on loses or fraud?

http://themerkle.com/steam-switched-back-to-zero-confirmation-bitcoin-transactions/
http://themerkle.com/vendor-using-bitpay-becomes-victim-of-five-bitcoin-double-spend-attacks/

Sooo, 1 conf for low money transactions and 3 for great quantity. It should be perfectly safe right? (althought "perfectly safe" shouldn't exist)

I'd say up to 1 BTC per confirmation up to 6; or 1 confirmation per 1 BTC. But don't complicate things, many exchanges accept 3 or 4 confirmations.

Well, Satoshi doesn't think 0 confirmations isn't that bad. So why should we be more concerned than the almighty creator of bitcoin!?



Thanks Satoshi. You've always got my back.

That was 6 years ago. Most sites require more than 0 confirmations. That online services I use show "Pending" about a few seconds after I send it some bitcoin. Then it shows the amount as usable after about 4 to 6 confirmations, or the equivalent blocks in one hour if they are accepting other altcoins such as Litecoin or Ether.

The amount of confirmations should be considered depending on the amount at stake.


Selling a cup of coffee? 1 transaction is probably sufficient.

Selling a high end computer? Might want to go 3-4

Selling cup of coffee? I'd look at the transaction on the live network, make sure it is not being actively double spent, see that it has propagated across the network, accept the payment, and go pour a cup. That should take about 20 seconds while the customer is waiting at the counter.

Selling a high end computer? This usually needs some assembly and testing time. Maybe 15 minutes, maybe 1 hour. Customer pays, and then I prepare the high end computer. By the time it's ready to get picked up or to be shipped, you'll have at least 1 confirmation, and maybe 6.

I think some are waiting for 3-4 confirmations because the fact that it cannot be undo anymore so the transaction is safe. Other than 1 confirmation only then you can cancel it and they will got nothing. And 6 is more preferrably as it is like " He is selling something then he has 3-4 customers saying it is legit then the other one is selling also but this time. 6 people testified that he is legit. So you will attempt to buy to a person who has more proof right?

The other thing is that, maybe when it reaches about 3-4, the waiting time for them to arrive your payment is much less other than one confirmation. From this moment, they should just spent some time for the payment to arrive and they don't require to wait for a time for the transaction to finish.

Please send me a 1BTC transaction and after 1 confirmation show me how you would 'cancel' said transaction. I'll be waiting eagerly to learn! 17GzDEfYm8xtwHjU5Wsbon6df4nzyoRPVt

It's only during certain times of the day. Just use a slightly higher fee, or use a site like coinbase since they pay the fees for you, at the cost of having control of your coins. A lot faster when it isn't a peak hour.

IMHO the most secure but at the same time fast way today is 3 confirmations just to confirm decentralization

In my opinion 0 confirmations would be enough in most cases, if your software / wallet is advanced enough and checks how many nodes received your transaction and if no competing transactions are broadcasted to the network.

If you are a webshop accepting payments a 0-confirmation bitcoin payment is far more secure than any creditcard transaction.

I tried to deposit from poloniex to coins.ph a site that convert bitcoin to cash, I noticed that unlike other exchanges, coins.ph allow the coin sent from poloniex to be spendable after one confirmation.  That was my first time experience to have bitcoin spendable with just  1 confirmation.   In a standard basis it needs  3 confirmation for the transaction to make your bitcoin spendable in that site.

I suppose it's a little different if you are changing money to another form of money. In your case bitcoin to cash. Then you probably have to wait 1 or more confirmations. If there is a fork or you put some effort and created a duplicate transaction, their money is gone.

But if you are selling goods or services online I think zero confirmations is worth the risk. Mostly the amount of bitcoin is small, and the product is probably only shipped or used a few hours later, so there still is time to cancel it.

Very good explanation as originally offered by Herbert2020 which summarises that the majority of users like us only need a single confirmation. Even the risk from a 2-confirmation tx was considered small in 2014, much more so today in 2017. I can easily see how progressively larger txs would require progressively more confirms.

I'd be interested to know how we might find these 3-block or even 6-block orphan you mentioned. What was the story behind that 6-block orphan?