<p>"Doublespend" refers to an attempt of spending the same funds twice. In Bitcoin specifically this occurs when a user publishes two transactions that are in conflict due to attempting to use the same <em>unspent transaction output</em> as input. Obviously, only one of the two transactions can be valid. </p>

<p>Before Bitcoin was published, the solution to the doublespending problem was to designate a central actor that decided which of the two transactions would take precedence. The central actor would do this by announcing which of the two it had <em>seen first</em>.</p>

<p>The "first-seen" behavior was at first explicitly encoded in node behavior: nodes would not accept a conflicting transaction into their mempool (the temporary storage of unconfirmed transactions). However, this lead to the <a href="https://bitcoin.stackexchange.com/q/20845/5406">incorrect assumption that zero confirmation transactions could be reliable</a> whereas actually the doublespending problem is solved by miners collecting transactions into blocks for confirmation. The blocks may only contain one of the two conflicting transactions, as otherwise the block is invalid. Thus, the blockchain specifies the precedence of transactions by converging on a common journal of the transactions without a central actor.</p>

<p>In the past months, we've seen the "first-seen" paradigm get softened significantly as doublespends (of unconfirmed transactions) have become more or less trivial due to the high demand for blockspace. As it is becoming common for users to update transactions with a higher fee (i.e. a doublespend), the "first seen" paradigm is falling out of use and being replaced by the defacto mechanism of "first-included". Assuming rational miner behavior selecting the most profitable transactions first, we will converge on a full replace-by-fee system eventually.</p>

<p>In other words, when the whitepaper describes the requirement for the Bitcoin system to create a convergent history with "first-seen", it describes a simplified situation that didn't account for the network dynamics of competition for blockspace. From today's perspective this should be understood as "first-confirmed".</p>

CC BY-SA 3.0
2017-06-19T11:42:38.687Z
oh.. i was thinking that "earliest transaction" refers to the first transaction in the history of every block-coin. But here earliest transaction means first transaction of 2 or more double-spends ?
Ashish Negi
CC BY-SA 3.0
2017-06-19T15:30:11.393Z
@AshishNegi: Correct, I don't see why the earliest transaction in the history of every block-coin would be especially interesting.
Murch
CC BY-SA 3.0
2018-04-14T09:17:45.643Z
Note that solutions did exist but were not complete.
Here is a paper predating bitcoin which describes a solution that mitigates the problem as much as possible - https://arxiv.org/abs/0802.0832v1
Nether
CC BY-SA 4.0
2021-12-30T21:02:57.223Z
with the dynamic of first included, could'nt a "hacker" spies a transaction with 1$ fee, take the private key inside and creates another transaction with the same private key and output to the hacker's wallet with 10$: then his transaction is first confirmed and the "true" transaction of 1$ fails. Am I wrong? If not, isn't it a big big flaw?
totalMongot
CC BY-SA 4.0
2021-12-30T21:30:07.783Z
Transactions don't include a private key, they include signatures. Signatures are created by using the private key to sign a specific message which in this case is a digest of the transaction. So, a signature is only valid in the context of the exact transaction, it proves that the signer had the private key, but it doesn't leak the private key itself.
Murch
CC BY-SA 4.0
2021-12-31T11:09:51.350Z
@Murch If I understand correctly, the "mix" of the private key and the timestamp/amount of transaction is made by the owner and he gives this mix = the signature to the blockchain. And somehow the blockchain can compare this signature to the public key?
totalMongot
CC BY-SA 4.0
2021-12-31T17:08:47.003Z
The signature is the result of a math function that uses a message and the private key as an input. It can be used in another math function using the signature, the message, and the public key to be verified. It cannot be used to learn the private key.—The blockchain doesn't do anything: every node on the network validates every transaction and block they receive. Then they only forward the valid data. Given that only valid data is forwarded and considered for the blockchain, that's what ends up being in the blockchain.
Murch
CC BY-SA 3.0
2017-06-18T18:47:39.533Z
2017-06-18T18:59:06.390Z
2017-06-18T18:59:06.390Z
Murch
<p>Bitcoin is made with distributed computing and mathemetical calculations as the proof of concept.</p>

<p>so, every time you make a transaction, it is broadcasted to the network and processed based on the fees and resources available. </p>

<p>Bitcoin don't trust any one, so it generally approves transaction after at least 6 more blocks/transactions are added to ledger.</p>

<p>so, if you want to do double spending, you will have to forge the other transaction with exactly prior timestamp, and you must process next six blocks prior to the whole bitcoin network in the world. To do so, you must acquire at least 51% of computation power of whole bitcoin network, which is not possible.</p>

<p>so, bitcoin will discard any duplicate transaction based on the longest transaction block-chain length.</p>

CC BY-SA 3.0
2017-06-12T15:07:30.893Z
even though whatever you have said is right, i don't understand where is the answer to my question about statement in paper.
Ashish Negi
CC BY-SA 3.0
2017-06-12T17:55:24.470Z
To forge double transaction, a user must have at least 51% computing power of the Bitcoin network(That is millions of miner and mining pools combined) to outperform the others in calculations and make his block chain longer. That is impossible!!!
so we can Surely say the Early transaction(with longer blockchain) is the valid one.
Jitendra
CC BY-SA 3.0
2017-06-13T05:48:38.817Z
In the chapter 2 of bitcoin paper, satoshi is not talking about 51 % computing power. Can you please rephrase your answer with respect to that chapter ? It will be more convincing. I have also updated the question with two paragraphs of that chapter.
Ashish Negi
CC BY-SA 3.0
2017-06-13T17:10:35.090Z
https://www.extremetech.com/extreme/184427-one-bitcoin-group-now-controls-51-of-total-mining-power-threatening-entire-currencys-safety

This article may help you to understand it.
Jitendra
CC BY-SA 3.0
2017-06-11T10:47:14.123Z
2017-06-11T10:47:14.123Z
Jitendra
<p>On page 2 of <a href="https://bitcoin.org/bitcoin.pdf" rel="nofollow noreferrer">Bitcoin paper</a>, it says:</p>

<blockquote>
  <p>The problem of course is the payee can't verify that one of the owners
  did not  double-spend the coin. A common solution is to introduce a
  trusted central authority, or mint, that checks every transaction for
  double spending. After each transaction, the coin must be returned to
  the mint to issue a new coin,    and only coins issued directly from
  the mint are trusted not to be double-spent. The problem with this
  solution is that the fate of the entire money system depends on the
  company running the mint, with every transaction having to go through
  them, just like a bank.</p>
  
  <p>We need a way for the payee to know that the previous owners did not
  sign any earlier transactions.
  <strong>For our purposes, the earliest transaction is the one that counts, so we don't care about later attempts to double-spend.</strong> [emphasis added]
   The only way to confirm the absence of a transaction is to be aware
  of all transactions. In the mint based model, the mint was aware of
  all transactions and decided which arrived first. To accomplish this
  without a trusted party, transactions must be publicly announced <a href="http://www.weidai.com/bmoney.txt," rel="nofollow noreferrer">[1]</a>,
  and we need a system for participants to agree on a single history of
  the order in which they were received. The payee needs proof that at
  the time of each transaction, the majority of nodes agreed it was the
  first received.</p>
</blockquote>

<p>Why does only the earliest transaction matter for double spending? 
I thought that it would be latest as previous owner would have checked till that. But even that is flawed... We need to check all.</p>

<p>Is it because the coin is a list of transactions and only first one is not verified?</p>

<doublespend><transaction-verification><transaction-selection><whitepaper>
Why does only the earliest transaction matter for double spending?
Ashish Negi
# Why does only the earliest transaction matter for double spending?

(Asked by: username_0 on 2017-06-11)

On page 2 of [Bitcoin paper](https://bitcoin.org/bitcoin.pdf), it says:

> The problem of course is the payee can't verify that one of the owners
> did not double-spend the coin. A common solution is to introduce a
> trusted central authority, or mint, that checks every transaction for
> double spending. After each transaction, the coin must be returned to
> the mint to issue a new coin, and only coins issued directly from
> the mint are trusted not to be double-spent. The problem with this
> solution is that the fate of the entire money system depends on the
> company running the mint, with every transaction having to go through
> them, just like a bank.
>
> We need a way for the payee to know that the previous owners did not
> sign any earlier transactions.
> **For our purposes, the earliest transaction is the one that counts, so we don't care about later attempts to double-spend.** [emphasis added]
> The only way to confirm the absence of a transaction is to be aware
> of all transactions. In the mint based model, the mint was aware of
> all transactions and decided which arrived first. To accomplish this
> without a trusted party, transactions must be publicly announced [[1]](http://www.weidai.com/bmoney.txt,),
> and we need a system for participants to agree on a single history of
> the order in which they were received. The payee needs proof that at
> the time of each transaction, the majority of nodes agreed it was the
> first received.

Why does only the earliest transaction matter for double spending?
I thought that it would be latest as previous owner would have checked till that. But even that is flawed... We need to check all.

Is it because the coin is a list of transactions and only first one is not verified?

**Tags:** doublespend, transaction-verification, transaction-selection, whitepaper


---

## 2 answers

### Answer by username_1 on 2017-06-18. Score: 3 | Accepted answer

"Doublespend" refers to an attempt of spending the same funds twice. In Bitcoin specifically this occurs when a user publishes two transactions that are in conflict due to attempting to use the same *unspent transaction output* as input. Obviously, only one of the two transactions can be valid.

Before Bitcoin was published, the solution to the doublespending problem was to designate a central actor that decided which of the two transactions would take precedence. The central actor would do this by announcing which of the two it had *seen first*.

The "first-seen" behavior was at first explicitly encoded in node behavior: nodes would not accept a conflicting transaction into their mempool (the temporary storage of unconfirmed transactions). However, this lead to the [incorrect assumption that zero confirmation transactions could be reliable](https://bitcoin.stackexchange.com/q/20845/5406) whereas actually the doublespending problem is solved by miners collecting transactions into blocks for confirmation. The blocks may only contain one of the two conflicting transactions, as otherwise the block is invalid. Thus, the blockchain specifies the precedence of transactions by converging on a common journal of the transactions without a central actor.

In the past months, we've seen the "first-seen" paradigm get softened significantly as doublespends (of unconfirmed transactions) have become more or less trivial due to the high demand for blockspace. As it is becoming common for users to update transactions with a higher fee (i.e. a doublespend), the "first seen" paradigm is falling out of use and being replaced by the defacto mechanism of "first-included". Assuming rational miner behavior selecting the most profitable transactions first, we will converge on a full replace-by-fee system eventually.

In other words, when the whitepaper describes the requirement for the Bitcoin system to create a convergent history with "first-seen", it describes a simplified situation that didn't account for the network dynamics of competition for blockspace. From today's perspective this should be understood as "first-confirmed".

> **Comments:**
> **username_0**: oh.. i was thinking that "earliest transaction" refers to the first transaction in the history of every block-coin. But here earliest transaction means first transaction of 2 or more double-spends ?  
> **username_1**: @username_0: Correct, I don't see why the earliest transaction in the history of every block-coin would be especially interesting.  
> **username_2**: Note that solutions did exist but were not complete. Here is a paper predating bitcoin which describes a solution that mitigates the problem as much as possible - https://arxiv.org/abs/0802.0832v1  
> **username_3**: with the dynamic of first included, could'nt a "hacker" spies a transaction with 1$ fee, take the private key inside and creates another transaction with the same private key and output to the hacker's wallet with 10$: then his transaction is first confirmed and the "true" transaction of 1$ fails. Am I wrong? If not, isn't it a big big flaw?  
> **username_1**: Transactions don't include a private key, they include signatures. Signatures are created by using the private key to sign a specific message which in this case is a digest of the transaction. So, a signature is only valid in the context of the exact transaction, it proves that the signer had the private key, but it doesn't leak the private key itself.  
> **username_3**: @username_1 If I understand correctly, the "mix" of the private key and the timestamp/amount of transaction is made by the owner and he gives this mix = the signature to the blockchain. And somehow the blockchain can compare this signature to the public key?  
> **username_1**: The signature is the result of a math function that uses a message and the private key as an input. It can be used in another math function using the signature, the message, and the public key to be verified. It cannot be used to learn the private key.—The blockchain doesn't do anything: every node on the network validates every transaction and block they receive. Then they only forward the valid data. Given that only valid data is forwarded and considered for the blockchain, that's what ends up being in the blockchain.  

---

### Answer by username_4 on 2017-06-11. Score: -1

Bitcoin is made with distributed computing and mathemetical calculations as the proof of concept.

so, every time you make a transaction, it is broadcasted to the network and processed based on the fees and resources available.

Bitcoin don't trust any one, so it generally approves transaction after at least 6 more blocks/transactions are added to ledger.

so, if you want to do double spending, you will have to forge the other transaction with exactly prior timestamp, and you must process next six blocks prior to the whole bitcoin network in the world. To do so, you must acquire at least 51% of computation power of whole bitcoin network, which is not possible.

so, bitcoin will discard any duplicate transaction based on the longest transaction block-chain length.

> **Comments:**
> **username_0**: even though whatever you have said is right, i don't understand where is the answer to my question about statement in paper.  
> **username_4**: To forge double transaction, a user must have at least 51% computing power of the Bitcoin network(That is millions of miner and mining pools combined) to outperform the others in calculations and make his block chain longer. That is impossible!!! so we can Surely say the Early transaction(with longer blockchain) is the valid one.  
> **username_0**: In the chapter 2 of bitcoin paper, satoshi is not talking about 51 % computing power. Can you please rephrase your answer with respect to that chapter ? It will be more convincing. I have also updated the question with two paragraphs of that chapter.  
> **username_4**: https://www.extremetech.com/extreme/184427-one-bitcoin-group-now-controls-51-of-total-mining-power-threatening-entire-currencys-safety  This article may help you to understand it.  

---

