Number of confirmations on output

[bitdude]

Hi,

when Bitcoin is accepted from an untrusted source, the operation is considered as finished when the number of confirmation goes to 6 (not relevant here that some services use 3 or different number).

This number is used when someone sends money and we are about to receive them. How does the situation change when we want to be sure that the coins are no longer available in the source account? Do we still need 6 confirmations here?

The situation is as follows:

Wallet A contains 1 BTC. Bob sends 1 BTC from address A to address B. We want to be sure, that Bob can not use that 1 BTC for anything else. When exactly are we sure about that (with a similar level of security as with 6 confirmations on receipt)? Is this exactly at the very same moment that we are sure that address B received 1 BTC with 6 confirmations?

Is it technically possible to create orders to send BTC from address that is empty?

Thank you for explanations.

[1714606365]

1714606365

[1714606365]

1714606365

[1714606365]

1714606365

[Sonny]

How does the situation change when we want to be sure that the coins are no longer available in the source account? Do we still need 6 confirmations here?

https://en.bitcoin.it/wiki/Confirmation

There is nothing special about the default, often-cited figure of 6 confirmations. It was chosen based on the assumption that an attacker is unlikely to amass more than 10% of the hashrate, and that a negligible risk of less than 0.1% is acceptable. Both these figures are arbitrary, however; 6 confirmations are overkill for casual attackers, and at the same time powerless against more dedicated attackers with much more than 10% hashrate.

Generally speaking, the more confirmations you get, it is more difficult for the transaction to be "revoked" or "cancelled".

Is it technically possible to create orders to send BTC from address that is empty?

It is indeed not easy to double-spend (or "revoke" / "cancel") a transaction, even when the transaction has only 2 confirmations.
To do so, the sender need to generate a longer blockchain than the current one and to orphan the current 2 blocks.
In other words, the sender need to find 3 blocks himself before the whole network find 1 block, (or the sender find 4 blocks before whole network find 2 blocks, blah blah blah), and it is very difficulty with the current hashrate.

https://en.bitcoin.it/wiki/Double-spending

[oxfardk]

it's technically possible to create orders to send BTC from address that is empty

[Abdussamad]

It's hard for ordinary users to double spend even 0 confirm transactions. You can try but it's rare for the double spend to succeed.

With that said if time is of the essence I would go with this:

For small amounts 1 confirmation. For medium sized amounts at least 2. For large amounts 3. For massive amounts 6.

Yes, waiting for confirmations is a PITA.

[R0yalAir]

it's a massive amount so that address B will need 6 confirmations

[DannyHamilton]

- snip -
when Bitcoin is accepted from an untrusted source, the operation is considered as finished when the number of confirmation goes to 6
- snip -
How does the situation change when we want to be sure that the coins are no longer available in the source account? Do we still need 6 confirmations here?
- snip -

You are saying the same thing both times, just using different words.

Notes:

• 6 confirmations does not provide 100% assurance that the transaction is permanent.  There is nothing magical about the number 6. Each confirmation reduces the risk more than the previous confirmation.  6 confirmations is just a reduction of risk to an acceptable level for most people.
• In most cases, 1 confirmation is sufficient to feel confident about a transaction

Personally, I use the following rule of thumb for transactions with an unknown and untrusted entity:

$0 to $1,000 worth of bitcoins, I require 1 confirmation.
$1,000 to $5,000 worth of bitcoins, I require 2 confirmations.
$5,000 to $50,000 worth of bitcoins, I require 3 confirmations.
$50,000 to $100,000 worth of bitcoins I require 4 confirmations.
$100,000 to $300,000 worth of bitcoins, I require 5 confirmations.
more than $300,000 worth of bitcoins, I require 6 confirmations.

Those numbers are adjusted down for things like face-to-face transactions or transactions with a party that I have some sort of trust relationship with.

[bitdude]

Thank you all for the answers.

For me personally, the most simple answer that cleared everything to me was this one:

it's technically possible to create orders to send BTC from address that is empty

As this is possible then the input and output security are equal. Further explanations are not necessary, but thank you for them too.

[Automatic]

- snip -
when Bitcoin is accepted from an untrusted source, the operation is considered as finished when the number of confirmation goes to 6
- snip -
How does the situation change when we want to be sure that the coins are no longer available in the source account? Do we still need 6 confirmations here?
- snip -

You are saying the same thing both times, just using different words.

Notes:

• 6 confirmations does not provide 100% assurance that the transaction is permanent.  There is nothing magical about the number 6. Each confirmation reduces the risk more than the previous confirmation.  6 confirmations is just a reduction of risk to an acceptable level for most people.
• In most cases, 1 confirmation is sufficient to feel confident about a transaction

Personally, I use the following rule of thumb for transactions with an unknown and untrusted entity:
-snip-
Those numbers are adjusted down for things like face-to-face transactions or transactions with a party that I have some sort of trust relationship with.

If you're going to follow that rule of thumb, why not just say "Anything under $25,000, one confirmation will do", as, to attack you, they'll be making at-least $25k, and, if they had that kind of profit rolling in, I'm sure they'd rather just legitimately make the money than awkwardly try and scam you.

Personally, I just say "Two confirmations flat out. Any amount.", purely because I find one is "eh", you wouldn't have to beat anyone, you'd just have to stall until you had a block, broadcast TX, then broadcast block.

EDIT:- Then again, my max trade is like $2k, I don't trade $300k+ in a single transaction, so, my values are more tailored to how I work, if you're doing a 300k+ transaction, I would probably wait for like fifty blocks.
/nowayinhellimgoingtolose$300k

[DannyHamilton]

- snip -
If you're going to follow that rule of thumb, why not just say "Anything under $25,000, one confirmation will do"
- snip -

Everyone has to choose their own levels of acceptable risk.  Those are mine.

[ZephramC]

Thank you all for the answers.

For me personally, the most simple answer that cleared everything to me was this one:

it's technically possible to create orders to send BTC from address that is empty

As this is possible then the input and output security are equal. Further explanations are not necessary, but thank you for them too.

There is a problem with consensus. The answer to the question "Is the address 1ABCD... empty?" is not unambiguous. Some nodes of the network (those informed of the transaction) will agree that it is empty (and they will drop any subsequent orders to spend from what they consider empty address). Some nodes can be isolated from the information and they will allow second (first in their view) spend from the address (and if they learn of the first "legitimate" spend later, they will drop it, because it will be second spend for them). This is effectively doublespend attempt, because there are two versions of spending specific coins (using one specific outupt as input in two different transactions) and different parts of Bitcoin network disagree which one is the legitimate one. Note that you can have also triplespend, quatrospend, etc.
It becomes clear as soon as some transaction (the one emptying wallet) is included in block. So even after one confirmation the (only one) transaction which gets included in the block is the one considered legitimate by all. However, although now it is clear which transaction is valid (the one in the longest blockchain), there can be change in the consensus "which blockchain is the longest one". So the (universally shared) validity can be revoked. But it is less and less probable with increasing number of confirmations (blocks built on top of block with legitimate transaction).

This is also (not very clean) way how to "add fees to existing transactions". If you send transaction with very low (or no) fees then it can take very long to confirm (include in block). Not only miners wont include it in block, but the transaction itself would not propagate across the Bitcoin network very well (nodes have rules for relaying transactions too). It might not even reach the miners. If you try to double spend the same coins (transaction with the same inputs, same outputs, but with different fees is essentially a different transaction) with higher fee, you will create transaction that will propagate much better (of course nodes already knowing about your previous no-fee transaction will ignore this second try, but such nodes wont be very common) and will likely be included sooner. Later, when no-fee transaction catches up, it will be dropped mercilessly as double spend.