Spending Unconfirmed Transactions?!

[Parham6]

You can tell that transactions can keep being broadcast, though, because sometimes you'll see double-spend attempts (two transactions will be pending, first one to make it into a block gets accepted and the other is thrown away).

Please define "thrown away", will it stay unconfirmed on the blockchain forever or will it just be deleted from there (is it even possible considering the protocol?!)?

The real question is, what if someone keeps broadcasting fake transactions from modified custom clients and everyone else accepts those and does the same? This way people could just generate fake unconfirmed coins out of thin air and send them around. But that's clearly not happening, so why is it not happening? And why won't it happen in the future?

If you can't delete entries from blockchain or client, imagine what would happen if someone (botnet?) sent a lot of unconfirmed fake transactions all around to confuse users. Many people could end up with dozens of fake unconfirmed transactions coming each minute to their random addresses. What if I start broadcasting thousands of 1 btc transactions to every address I could find here hundreds of times?

POST IS EDITED

[ranlo]

You can tell that transactions can keep being broadcast, though, because sometimes you'll see double-spend attempts (two transactions will be pending, first one to make it into a block gets accepted and the other is thrown away).

Please define "thrown away", will it stay unconfirmed on the blockchain forever or will it just be deleted from there (is it even possible considering the protocol?!)?

The real question is, what if someone keeps broadcasting fake transactions from modified custom clients and everyone else accepts those and does the same? This way people could just generate fake unconfirmed coins out of thin air and send them around. But that's clearly not happening, so why is it not happening? And why won't it happen in the future?

I think the secondary transactions remain unconfirmed. You can read more here: https://en.bitcoin.it/wiki/Double-spending

Why doesn't it happen a lot? Because it would do no good. Even casinos that allow instant deposits won't let you withdraw until the deposits have been confirmed.

[Parham6]

Why doesn't it happen a lot? Because it would do no good. Even casinos that allow instant deposits won't let you withdraw until the deposits have been confirmed.

What if someone (with a large botnet) starts sending thousands of fake broadcasts to legit addresses each minute as long as he can with intend to confuse and overload (not literally) the system? If someone sends you dozens of fake 1 btc income that will stay unconfirmed forever, wouldn't that confuse you? What if you change your address, send your bitcoins there and he still tracks you and keep doing the same? What if you were to receive dozens of random fake btc each minute, can you really operate with that happening? It's really easy to broadcast a >1KB transaction to the nodes. If that happens, how will you know what's legit and what's not?

[shorena]

-snip-
B sends the unconfirmed 1 btc from A to C, both are unconfirmed now.
-snip-

That is not possible. B can only send what has been send to B. B can not spend someone elses coins (e.g. A's). If that would be possible I could just spend your coins. But you probably want to say that B spend the coins that did not belong to B at that point. Which makes an invalid transaction. They will be "dropped" / "thrown away". See below...

-snip-
Please define "thrown away", will it stay unconfirmed on the blockchain forever or will it just be deleted from there (is it even possible considering the protocol?!)?
-snip-

An unconfimred transaction is not on the blockchain yet. It is just in the collective memory of all (or some) nodes. Only if it is valid it has a chance to be stored in a block and be part of the blockchain. This can only happen if all inputs are valid. This is checked by the miners. If a miner would include a fake (as in invalid) transaction in a new block, this block would not be accepted by the other miners. The block would be "orphaned".

 

Why doesn't it happen a lot? Because it would do no good. Even casinos that allow instant deposits won't let you withdraw until the deposits have been confirmed.

What if someone (with a large botnet) starts sending thousands of fake broadcasts to legit addresses each minute as long as he can with intend to confuse and overload (not literally) the system? If someone sends you dozens of fake 1 btc income that will stay unconfirmed forever, wouldn't that confuse you? What if you change your address, send your bitcoins there and he still tracks you and keep doing the same? What if you were to receive dozens of random fake btc each minute, can you really operate with that happening? It's really easy to broadcast a >1KB transaction to the nodes. If that happens, how will you know what's legit and what's not?

I am not sure how the network would react to an attack like this. But its not "confusing" the nodes as they can check whether a transaction is valid or not.

[Parham6]

I just happened today again I made two screenshots which you can see below, one from Multibit 0.5.18 and from from Blockchain.info:




I can't normally do that, it gives an error saying Not Enough Balance until my funds get at least 1 confirmation.

But its not "confusing" the nodes as they can check whether a transaction is valid or not.

No, it's confusing the users. How can you tell what's legit and what's not if you suddenly receive hundreds of random income from random wallet addresses?

[shorena]

I just happened today again I made two screenshots which you can see below, one from Multibit 0.5.18 and from from Blockchain.info:




I can't normally do that, it gives an error saying Not Enough Balance until my funds get at least 1 confirmation.

This is really confusing because everything is just grey blocks.

Well... can be found anyway

TX1 is this: 8043-snip-
TX2 is this: f350-snip-

If those are not yours, we can just use them anyway since they are similar enough.


Disclaimer:
I decided not to post these as you did not do so yourself. I understand that you want to remain as anonymous as possible, but sometimes -esp. if you need help- you need to reveal some information. I personally dont see a problem with reveiling 2 addresses and some tx-ids. I however do not know you or your bussiness, so I can't be the judge of that.

Lets get to the point


According to https://en.bitcoin.it/wiki/Protocol_rules#.22tx.22_messages we have a set of rules that make a TX valid or invalid.

Rule 10 says:

For each input, look in the main branch and the transaction pool to find the referenced output transaction. If the output transaction is missing for any input, this will be an orphan transaction. Add to the orphan transactions, if a matching transaction is not in there already.

It looks like this is only possible if the mining pool received both of your transactions and has knowledge of both transactions. Your Multibit has knowledge of the first transaction when the 2nd is made. So Rule 12

For each input, if the referenced output does not exist (e.g. never existed or has already been spent), reject this transaction

I had in mind the whole time, does not apply. This only works if both transactions get accepted in the same block or tx1 gets accepted in a block earlier than tx2.

This however does not explain why your client sometimes refuses to do this. This should allways be possible given enough time. This might be an issue with the fact that multibit has a central blockchain and you do not have a local copy.

-snip-
No, it's confusing the users. How can you tell what's legit and what's not if you suddenly receive hundreds of random income from random wallet addresses?

That might be the case indeed. You are thinking about tx2 in the above example without tx1, correct?
If a node gets tx2 before tx1 it should just not save it and not broadcast it further because without knowledge of tx1 the transaction tx2 is not valid. So unless you will finally receive the coins this should not show up in your client.

[Parham6]

Yeah, but I know not everyone can find it anyway so it's better than leaving them exposed. And no I'm not thinking about tx2, you get some base amount in first then send countless tx2s with 0 fees and 1 satoshi amount.

[shorena]

Yeah, but I know not everyone can find it anyway so it's better than leaving them exposed.

Id do it differently, but I understand. Thats why I decided to keep them out. In case you are wondering, they never hit the server, I edited localy before the first post.

And no I'm not thinking about tx2, you get some base amount in first then send countless tx2s with 0 fees and 1 satoshi amount.

IIRC 1 satoshi is not enough for some reason, must be at least 452 satoshi or something like that. Not sure about the number. But the problem is the same ofc. If I get 500 inputs with 500 satoshi each that are not confirmed, its a lot of spam on my client. I read somewhere that very small transactions are used as advertising, as you can add "buy at XY" on blockchain.info for the output address.
I guess (not sure If I miss something) it would be possible to spam someone with very small transactions. Its spamming with money, but a truckload of penny's at your door is still annoying.
hmmm... should test that on the testnet

[Parham6]

Yeah, but I know not everyone can find it anyway so it's better than leaving them exposed.

Id do it differently, but I understand. Thats why I decided to keep them out. In case you are wondering, they never hit the server, I edited localy before the first post.

And no I'm not thinking about tx2, you get some base amount in first then send countless tx2s with 0 fees and 1 satoshi amount.

IIRC 1 satoshi is not enough for some reason, must be at least 452 satoshi or something like that. Not sure about the number. But the problem is the same ofc. If I get 500 inputs with 500 satoshi each that are not confirmed, its a lot of spam on my client. I read somewhere that very small transactions are used as advertising, as you can add "buy at XY" on blockchain.info for the output address.
I guess (not sure If I miss something) it would be possible to spam someone with very small transactions. Its spamming with money, but a truckload of penny's at your door is still annoying.
hmmm... should test that on the testnet

Well, thank you so much for the clarification and your thorough replies, I'm gonna lock the thread now since I've already got my answer from you. Thanks again!