<p>You can check if a transaction includes a fee just by looking at its inputs and outputs (you can also access this information at <a href="http://blockexplorer.com" rel="nofollow noreferrer">blockexplorer.com</a>).</p>

<p>But you are correct: accepting transactions with 0 confirmations is risky and there are other attacks besides the one you mentioned (the <a href="https://bitcoin.stackexchange.com/questions/658/what-can-an-attacker-with-51-of-hash-power-do">51% attack</a> and the <a href="https://bitcoin.stackexchange.com/questions/1184/what-can-be-done-to-mitigate-the-risk-of-a-finney-attack">Finney attack</a>, for example).</p>

<p>Here are a few options to defend against this:</p>

<ul>
<li>Wait for more confirmations - this may not be desirable but it works</li>
<li>Accept payments from an e-wallet/exchange like <a href="https://bitcoin.stackexchange.com/questions/1859/for-instant-payments-with-transaction-with-no-fee-be-an-issue/1862#1862">parker_vmg3 mentioned</a> - some websites such as TradeHill or CampBX allow you to send bitcoins instantaneously between members</li>
<li>Use <a href="https://bitcoin.stackexchange.com/questions/1730/what-are-green-addresses">green addresses</a> - currently these are only available at MtGox and InstaWallet, but they might become more popular in the future</li>
</ul>

CC BY-SA 3.0
2011-11-03T13:00:38.623Z
While 0 confirmations have risk the risk for small value purchases is likely less than accepting credit cards especially when you consider the added cost of chargeback fees.  All risk is relative.  While there is risk of loss with 0 confirms the risk of loss is never 0 even with 6 confirmations.  One has to weigh the cost of requiring multiple confirms (less user friendly = less sales) to the very low risk of getting double spend.
DeathAndTaxes
CC BY-SA 3.0
2011-11-03T12:45:30.793Z
2011-11-03T12:45:30.793Z
2017-04-13T12:47:33.610Z
nmat
<p>It should get picked up eventually, but yes, the user could double-spend before that.</p>

<p>That is exactly what confirmations are for. But it is probably unlikely that you would see massive amounts of "piracy" due to this. I'd just write that off as a cost of doing business. If it does get out of hand, you can go back to waiting for confirmations or accepting "green addresses". </p>

<p>Also keep in mind that if the users are not anonymous towards you (i.e. they maintain some kind of relationship with you, even just a user registration), you have recourse (you can refuse to continue offering them access until the scores are settled). </p>

<p>It is a trade-off between relying on trust (that the user pays) versus waiting for the amount of time it takes for the confirmations.</p>

CC BY-SA 3.0
2011-11-03T11:34:10.237Z
2011-11-03T11:34:10.237Z
Thilo
<p>The risk of a transaction never getting picked up is essentially zero.  Currently blocks are on average only 5% "full" so miners and mining pools tend to include all transactions.  For a transaction to never be included it would require that no miner on the planet ever include this transaction.  </p>

<p>If it did become a risk you could always require a fee is user wants to download at 0-confirms.  You can enforce this by checking the transaction.  The fee amount if the difference between inputs and outputs.  If they are the same then there is no fee.  For users which ignore your instructions and submit a no-fee transaction you could then just wait for 1 confirmation.</p>

<p>The greater risk comes from a "double spend" or "51% attack" however these risks are often overestimated. Allowing digital downloads paid by credit card has risk too so achieving 0% risk isn't a viable business strategy.  Even if your software never has credit card fraud is likely has losses due to piracy so the best solution is one that maximizes net revenue not one that attempts to eliminate all fraud. </p>

<p>Each business needs to look at the risk of their specific product.  The higher the value the more likely you should consider using confirmaiton. There is little value in executing a double spend attack to get a 1 BTC ($3 USD as of writing) copy of say "Super Angry Birds".  Allowing instant downloads likely improves sales enought offset any neglible increase in fraud.   On the other hand if you are allowing downloads &amp; license keys for SQL Server Enterprise at 2500 BTC a copy you probably should require confirmations.  </p>

<p><strong>Confirmation can only reduce not eliminate risk.</strong> The less risk you have at 0 conifrms the less benefit there is in delaying your customers. The real question then becomes does the delay end up costing you more revenue than it saves you in near non-existant fraud.</p>

CC BY-SA 3.0
2011-11-04T06:49:24.460Z
+1 for "the best solution is one that maximizes net revenue not one that attempts to eliminate all fraud"
Thilo
CC BY-SA 3.0
2011-11-03T13:07:57.937Z
2011-11-03T13:41:59.580Z
2011-11-03T13:41:59.580Z
DeathAndTaxes
<p>If I understand you question correctly, you could get them to give you an instawallet or maybe strongcoin address as a link where you could transfer funds directly into your wallet. </p>

CC BY-SA 3.0
2011-11-03T12:17:49.717Z
2011-11-03T12:17:49.717Z
parker_vmg3
<p>Let's say I want to accept payments instantly on a site for digital downloads.</p>

<p>So I publish an address and wait for the unconfirmed transaction, I see the transaction and release the digital download.</p>

<p>However the user may have sent the transaction with no fee. Therefore the miners may not pick it up or the user could issue a new transaction with a fee that gets processed into the block chain.</p>

<p>Is my thinking correct ? and is there away to stop this king of attack ?</p>

CC BY-SA 3.0
2013-07-13T13:27:21.647Z
To stop the attack you could wait for the confirms and then send an email "your download is ready" if that works for your type of business.
David Silva Smith
CC BY-SA 3.0
2011-11-03T13:48:52.647Z
See also http://bitcoin.stackexchange.com/questions/1869/how-to-perform-a-double-spend-attack-in-websites-that-accept-transactions-with-0
ripper234
<transactions><security><attack><doublespend>
Do no-fee transaction represent a greater risk if the product is delivered instantly?
Ian Purton
# Do no-fee transaction represent a greater risk if the product is delivered instantly?

(Asked by: username_0 on 2011-11-03)

Let's say I want to accept payments instantly on a site for digital downloads.

So I publish an address and wait for the unconfirmed transaction, I see the transaction and release the digital download.

However the user may have sent the transaction with no fee. Therefore the miners may not pick it up or the user could issue a new transaction with a fee that gets processed into the block chain.

Is my thinking correct ? and is there away to stop this king of attack ?

**Tags:** transactions, security, attack, doublespend

> **Comments:**
> **username_2**: See also http://bitcoin.stackexchange.com/questions/1869/how-to-perform-a-double-spend-attack-in-websites-that-accept-transactions-with-0  
> **username_1**: To stop the attack you could wait for the confirms and then send an email "your download is ready" if that works for your type of business.  

---

## 4 answers

### Answer by username_3 on 2011-11-03. Score: 3 | Accepted answer

You can check if a transaction includes a fee just by looking at its inputs and outputs (you can also access this information at [blockexplorer.com](http://blockexplorer.com)).

But you are correct: accepting transactions with 0 confirmations is risky and there are other attacks besides the one you mentioned (the [51% attack](https://bitcoin.stackexchange.com/questions/658/what-can-an-attacker-with-51-of-hash-power-do) and the [Finney attack](https://bitcoin.stackexchange.com/questions/1184/what-can-be-done-to-mitigate-the-risk-of-a-finney-attack), for example).

Here are a few options to defend against this:

* Wait for more confirmations - this may not be desirable but it works
* Accept payments from an e-wallet/exchange like [parker\_vmg3 mentioned](https://bitcoin.stackexchange.com/questions/1859/for-instant-payments-with-transaction-with-no-fee-be-an-issue/1862#1862) - some websites such as TradeHill or CampBX allow you to send bitcoins instantaneously between members
* Use [green addresses](https://bitcoin.stackexchange.com/questions/1730/what-are-green-addresses) - currently these are only available at MtGox and InstaWallet, but they might become more popular in the future

> **Comments:**
> **username_4**: While 0 confirmations have risk the risk for small value purchases is likely less than accepting credit cards especially when you consider the added cost of chargeback fees.  All risk is relative.  While there is risk of loss with 0 confirms the risk of loss is never 0 even with 6 confirmations.  One has to weigh the cost of requiring multiple confirms (less user friendly = less sales) to the very low risk of getting double spend.  

---

### Answer by username_5 on 2011-11-03. Score: 3

It should get picked up eventually, but yes, the user could double-spend before that.

That is exactly what confirmations are for. But it is probably unlikely that you would see massive amounts of "piracy" due to this. I'd just write that off as a cost of doing business. If it does get out of hand, you can go back to waiting for confirmations or accepting "green addresses".

Also keep in mind that if the users are not anonymous towards you (i.e. they maintain some kind of relationship with you, even just a user registration), you have recourse (you can refuse to continue offering them access until the scores are settled).

It is a trade-off between relying on trust (that the user pays) versus waiting for the amount of time it takes for the confirmations.


---

### Answer by username_4 on 2011-11-03. Score: 2

The risk of a transaction never getting picked up is essentially zero. Currently blocks are on average only 5% "full" so miners and mining pools tend to include all transactions. For a transaction to never be included it would require that no miner on the planet ever include this transaction.

If it did become a risk you could always require a fee is user wants to download at 0-confirms. You can enforce this by checking the transaction. The fee amount if the difference between inputs and outputs. If they are the same then there is no fee. For users which ignore your instructions and submit a no-fee transaction you could then just wait for 1 confirmation.

The greater risk comes from a "double spend" or "51% attack" however these risks are often overestimated. Allowing digital downloads paid by credit card has risk too so achieving 0% risk isn't a viable business strategy. Even if your software never has credit card fraud is likely has losses due to piracy so the best solution is one that maximizes net revenue not one that attempts to eliminate all fraud.

Each business needs to look at the risk of their specific product. The higher the value the more likely you should consider using confirmaiton. There is little value in executing a double spend attack to get a 1 BTC ($3 USD as of writing) copy of say "Super Angry Birds". Allowing instant downloads likely improves sales enought offset any neglible increase in fraud. On the other hand if you are allowing downloads & license keys for SQL Server Enterprise at 2500 BTC a copy you probably should require confirmations.

**Confirmation can only reduce not eliminate risk.** The less risk you have at 0 conifrms the less benefit there is in delaying your customers. The real question then becomes does the delay end up costing you more revenue than it saves you in near non-existant fraud.

> **Comments:**
> **username_5**: +1 for "the best solution is one that maximizes net revenue not one that attempts to eliminate all fraud"  

---

### Answer by username_6 on 2011-11-03. Score: 0

If I understand you question correctly, you could get them to give you an instawallet or maybe strongcoin address as a link where you could transfer funds directly into your wallet.


---

