<blockquote>
  <p>What could be done in order protect against such an attack?</p>
</blockquote>

<p>Wait for N confirmations before accepting a payment as successful.</p>

CC BY-SA 3.0
2013-04-04T12:44:17.237Z
What happens if I have an Android app that broadcasts two transactions, spending the same input, to a different set of nodes whenever I pay for coffee? Only one of them will be mined into one of the next blocks, but does it mean I have to wait for ~10 minutes at the coffee shop?
nivs
CC BY-SA 3.0
2013-04-04T12:46:49.527Z
@nivs exactly. Of course, for very small amounts that isn't important. In case it will ever be, that is fixed using third party services, similar to how debit cards work.
o0'.
CC BY-SA 3.0
2013-04-04T12:53:24.363Z
Using third party services (especially for processing small payments) breaks one of the most important benefits of bitcoin.
nivs
CC BY-SA 3.0
2013-04-04T12:54:14.960Z
@nivs or you can wait 10 minutes, if you prefer.
o0'.
CC BY-SA 3.0
2013-04-04T13:06:50.410Z
@nivs With regards to the coffee shop situation, there still is some protection. I can look for that unconfirmed transaction. It isn't conclusive until its been mined and confirmed sufficiently, because a double spend could be hidingin an obscure part of the network and until the transaction is mined and confirmed it isn't 100% protected against that kind of deliberate double spend. But there are some risks with fiat currency as well (counterfeit, for example) and a vendor like a coffee shop will typically absorb those small risk in favor of customer convenience.
David Ogren
CC BY-SA 3.0
2013-04-08T16:50:31.480Z
The coffee shop is also at risk that you'll run off without paying!  In the future, escrow services like nivs mentions will exist but very few places will use them, because if the transaction is big enough, you can wait 60 minutes, and if it's small, you'll trust the customer not to run away, same as today.
Eyal
CC BY-SA 3.0
2013-04-04T10:49:43.060Z
2013-04-04T10:49:43.060Z
o0'.
<p>If you try to spend the same coins twice, proper clients won't accept the block as valid.  Read rules 9 and 14 here:</p>

<p><a href="https://en.bitcoin.it/wiki/Protocol_rules#.22tx.22_messages" rel="nofollow">https://en.bitcoin.it/wiki/Protocol_rules#.22tx.22_messages</a></p>

<p>Double-spend could occur if the transaction history forks, but forks don't usually last very long.  Having 6 confirmations after the transaction should be sufficient.</p>

CC BY-SA 3.0
2013-04-08T06:27:09.407Z
I think the malicious attempts refers to 0/unconfirmed "race attack" and not any mining-related attack.
Stephen Gornick
CC BY-SA 3.0
2013-04-04T10:50:28.360Z
2013-04-04T10:50:28.360Z
Eyal
<p>Say a malicious mobile bitcoin client is created, programmed to quickly send two or more double-send transactions whenever a payment is made.  </p>

<p>Is this an attack vector we should be concerned of?<br>
What could be done in order protect against such an attack?</p>

CC BY-SA 3.0
2013-04-04T10:49:03.917Z
"rouge"? Maybe you mean "rogue", but then it's not the correct word anyway.
o0'.
CC BY-SA 3.0
2013-04-04T12:46:50.183Z
Thanks, I corrected to "rogue", and I think it means what I think it means - a dishonest, knavish person; scoundrel.
nivs
CC BY-SA 3.0
2013-04-04T12:47:43.407Z
that's not what "rogue" mean in the context of Internet. You'd better use "fraudolent" or similar terms. "rogue" usually means a single cell or small group gone wild: related, but not exact.
o0'.
CC BY-SA 3.0
2013-04-04T12:50:25.790Z
"_A Cornell University commission said yesterday that a graduate student in computer science, working alone, created the **rogue program that produced havoc in nationwide computer networks** last November_" ([source](http://www.nytimes.com/1989/04/04/us/student-blamed-for-rogue-computer-program.html))
nivs
CC BY-SA 3.0
2013-04-04T12:52:50.673Z
exactly, that was a program roaming free about the Internet causing pain. It is a term suited to viruses and similar wandering things, not to tools like yours.
o0'.
CC BY-SA 3.0
2013-04-04T12:54:30.897Z
let's agree on malicious? ;)
nivs
CC BY-SA 3.0
2013-04-04T15:12:32.537Z
I touched on this a little in [my answer](http://bitcoin.stackexchange.com/a/8570/1409) to [Is there a risk of double-spending when making a face-to-face transaction?](http://bitcoin.stackexchange.com/questions/8563/is-there-a-risk-of-double-spending-when-making-a-face-to-face-transaction/8570#8570).
Colin Dean
CC BY-SA 3.0
2013-04-06T17:37:06.380Z
@StephenGornick I added this question because I was interested in learning about what would happen if a mobile bitcoin client, specially crafted for performing double spends, was developed.
nivs
<doublespend>
Can double-spends be automated by malicious custom bitcoin clients?
nivs
# Can double-spends be automated by malicious custom bitcoin clients?

(Asked by: username_0 on 2013-04-04)

Say a malicious mobile bitcoin client is created, programmed to quickly send two or more double-send transactions whenever a payment is made.

Is this an attack vector we should be concerned of?  
What could be done in order protect against such an attack?

**Tags:** doublespend

> **Comments:**
> **username_1**: "rouge"? Maybe you mean "rogue", but then it's not the correct word anyway.  
> **username_0**: Thanks, I corrected to "rogue", and I think it means what I think it means - a dishonest, knavish person; scoundrel.  
> **username_1**: that's not what "rogue" mean in the context of Internet. You'd better use "fraudolent" or similar terms. "rogue" usually means a single cell or small group gone wild: related, but not exact.  
> **username_0**: "_A Cornell University commission said yesterday that a graduate student in computer science, working alone, created the **rogue program that produced havoc in nationwide computer networks** last November_" ([source](http://www.nytimes.com/1989/04/04/us/student-blamed-for-rogue-computer-program.html))  
> **username_1**: exactly, that was a program roaming free about the Internet causing pain. It is a term suited to viruses and similar wandering things, not to tools like yours.  
> **username_0**: let's agree on malicious? ;)  
> **username_2**: I touched on this a little in [my answer](http://bitcoin.stackexchange.com/a/8570/1409) to [Is there a risk of double-spending when making a face-to-face transaction?](http://bitcoin.stackexchange.com/questions/8563/is-there-a-risk-of-double-spending-when-making-a-face-to-face-transaction/8570#8570).  
> **username_0**: @StephenGornick I added this question because I was interested in learning about what would happen if a mobile bitcoin client, specially crafted for performing double spends, was developed.  

---

## 2 answers

### Answer by username_1 on 2013-04-04. Score: 2

> What could be done in order protect against such an attack?

Wait for N confirmations before accepting a payment as successful.

> **Comments:**
> **username_0**: What happens if I have an Android app that broadcasts two transactions, spending the same input, to a different set of nodes whenever I pay for coffee? Only one of them will be mined into one of the next blocks, but does it mean I have to wait for ~10 minutes at the coffee shop?  
> **username_1**: @username_0 exactly. Of course, for very small amounts that isn't important. In case it will ever be, that is fixed using third party services, similar to how debit cards work.  
> **username_0**: Using third party services (especially for processing small payments) breaks one of the most important benefits of bitcoin.  
> **username_1**: @username_0 or you can wait 10 minutes, if you prefer.  
> **username_3**: @username_0 With regards to the coffee shop situation, there still is some protection. I can look for that unconfirmed transaction. It isn't conclusive until its been mined and confirmed sufficiently, because a double spend could be hidingin an obscure part of the network and until the transaction is mined and confirmed it isn't 100% protected against that kind of deliberate double spend. But there are some risks with fiat currency as well (counterfeit, for example) and a vendor like a coffee shop will typically absorb those small risk in favor of customer convenience.  
> **username_4**: The coffee shop is also at risk that you'll run off without paying!  In the future, escrow services like username_0 mentions will exist but very few places will use them, because if the transaction is big enough, you can wait 60 minutes, and if it's small, you'll trust the customer not to run away, same as today.  

---

### Answer by username_4 on 2013-04-04. Score: -3

If you try to spend the same coins twice, proper clients won't accept the block as valid. Read rules 9 and 14 here:

<https://en.bitcoin.it/wiki/Protocol_rules#.22tx.22_messages>

Double-spend could occur if the transaction history forks, but forks don't usually last very long. Having 6 confirmations after the transaction should be sufficient.

> **Comments:**
> **username_5**: I think the malicious attempts refers to 0/unconfirmed "race attack" and not any mining-related attack.  

---

