Can double-spends be automated by malicious custom bitcoin clients?

Question

Say a malicious mobile bitcoin client is created, programmed to quickly send two or more double-send transactions whenever a payment is made.

Is this an attack vector we should be concerned of?
What could be done in order protect against such an attack?

"rouge"? Maybe you mean "rogue", but then it's not the correct word anyway. — o0'., Apr 04 '13 at 10:49
Thanks, I corrected to "rogue", and I think it means what I think it means - a dishonest, knavish person; scoundrel. — nivs, Apr 04 '13 at 12:46
that's not what "rogue" mean in the context of Internet. You'd better use "fraudolent" or similar terms. "rogue" usually means a single cell or small group gone wild: related, but not exact. — o0'., Apr 04 '13 at 12:47
"A Cornell University commission said yesterday that a graduate student in computer science, working alone, created the rogue program that produced havoc in nationwide computer networks last November" (source) — nivs, Apr 04 '13 at 12:50
exactly, that was a program roaming free about the Internet causing pain. It is a term suited to viruses and similar wandering things, not to tools like yours. — o0'., Apr 04 '13 at 12:52
I touched on this a little in my answer to Is there a risk of double-spending when making a face-to-face transaction?. — Colin Dean, Apr 04 '13 at 15:12
@StephenGornick I added this question because I was interested in learning about what would happen if a mobile bitcoin client, specially crafted for performing double spends, was developed. — nivs, Apr 06 '13 at 17:37

score 2 · Answer 1 · answered Apr 04 '13 at 10:49

2

What could be done in order protect against such an attack?

Wait for N confirmations before accepting a payment as successful.

answered Apr 04 '13 at 10:49

o0'.

5,240
6
39
66

What happens if I have an Android app that broadcasts two transactions, spending the same input, to a different set of nodes whenever I pay for coffee? Only one of them will be mined into one of the next blocks, but does it mean I have to wait for ~10 minutes at the coffee shop? – nivs Apr 04 '13 at 12:44
@nivs exactly. Of course, for very small amounts that isn't important. In case it will ever be, that is fixed using third party services, similar to how debit cards work. – o0'. Apr 04 '13 at 12:46
Using third party services (especially for processing small payments) breaks one of the most important benefits of bitcoin. – nivs Apr 04 '13 at 12:53
@nivs or you can wait 10 minutes, if you prefer. – o0'. Apr 04 '13 at 12:54
3

@nivs With regards to the coffee shop situation, there still is some protection. I can look for that unconfirmed transaction. It isn't conclusive until its been mined and confirmed sufficiently, because a double spend could be hidingin an obscure part of the network and until the transaction is mined and confirmed it isn't 100% protected against that kind of deliberate double spend. But there are some risks with fiat currency as well (counterfeit, for example) and a vendor like a coffee shop will typically absorb those small risk in favor of customer convenience. – David Ogren Apr 04 '13 at 13:06
1

The coffee shop is also at risk that you'll run off without paying! In the future, escrow services like nivs mentions will exist but very few places will use them, because if the transaction is big enough, you can wait 60 minutes, and if it's small, you'll trust the customer not to run away, same as today. – Eyal Apr 08 '13 at 16:50

score -3 · Answer 2 · answered Apr 04 '13 at 10:50

-3

If you try to spend the same coins twice, proper clients won't accept the block as valid. Read rules 9 and 14 here:

https://en.bitcoin.it/wiki/Protocol_rules#.22tx.22_messages

Double-spend could occur if the transaction history forks, but forks don't usually last very long. Having 6 confirmations after the transaction should be sufficient.

answered Apr 04 '13 at 10:50

Eyal

1,669
9
14

I think the malicious attempts refers to 0/unconfirmed "race attack" and not any mining-related attack. – Stephen Gornick Apr 08 '13 at 06:27

Can double-spends be automated by malicious custom bitcoin clients?

2 Answers2