67

In Bitcoin, 6 confirmations are considered secure (very low probability of transaction/block reversal).

What is the current number in Ethereum?

Improve this question
2
  • 1
    Eth, you are talking about confirming a block here, right? I ask because of the comment lungj made to my question here: ethereum.stackexchange.com/questions/21686/… - Your clarification, would be great.
    – Tesa
    Jul 27, 2017 at 22:48
  • @Tesa I understand the terminology isn't great. You would say a transaction has 6 confirmations; but we don't really say that blocks get confirmed and it's unusual to say that a block has 6 confirmations. A well-written definition from Bitcoin: "confirmations represent the number of blocks in the block chain that have been accepted by the network since the block that includes the transaction." (When we get to Proof of Stake, there are notions of blocks getting finalized.)
    – eth ♦
    Aug 10, 2017 at 6:09

6 Answers 6

Reset to default
49

From George Hallam:

12 confirmations; however, exchanges and entities handling very large amounts of Ether frequently are still encouraged to run two different Ethereum implementations and only accept transactions that have been confirmed by both for maximum security (e.g. Go & C++).

For reference, 12 confirmations is approximately 3 minutes.

Improve this answer
4
  • 9
    Can you please provide a reference to why 12 confirmations is a good number?
    – Moe Elsharif
    Jan 9, 2018 at 10:43
  • 1
    This article discusses waiting an on appropriate value to be gathered by miners before considering the transaction complete. The value is proportional to the value you are transacting. Called the 'Ou Rule' in the article: medium.com/@nic__carter/…
    – Paul S
    Jul 24, 2019 at 0:19
  • What happens when a fork goes beyond 12 blocks but you're only checking for 12 confirmations?
    – anotherDev
    Aug 8, 2021 at 9:38
  • In that case you need to wait which of the two or more competing chains will become the excepted/main one. Exchanges usually freeze withdrawals when that happens. And it did happen few times in the past.
    – user2340939
    May 1 at 12:17
27

The geth client waits 5 blocks for confirmation of fresh minted blocks (around 1 minute).

I0201 19:07:07.354260    9098 worker.go:349] 🔨  Mined block (#1483 / a2648b58). Wait 5 blocks for confirmation

To make sure a block is no uncle or a transaction included in a block does not hang up in an ommer, I would suggest waiting 7 confirmations (around 2 minutes). From the whitepaper:

An uncle included in block B must have the following properties: [...] It must be a direct child of the kth generation ancestor of B, where 2 <= k <= 7. [...]

Miners need to check the parameters of the last 250 blocks. If you want to be on the most secure chain, with all feet on the ground, do it like the miners and wait for 250 confirmations (around 1 hour).

Some exchanges practice a double-all-in and even wait for 500 confirmations (about 2 hours). This might come along with the security warning that is readable everywhere because frontier is still not considered to be stable. I guess that's overkill.

To sum up, it always depends on your application and the attached value to consider which number of confirmations is considered to be secure.

Improve this answer
3
16

Ethereum theoretically approaches finality in less time than Bitcoin, due to the GHOST protocol. This means that, with a 15 second block time, roughly 40 blocks are needed to match the 60 minutes that 6 Bitcoin blocks takes.

Therefore, assuming no major consensus bugs, 40 confirmations should be more secure than 6 confirmations in bitcoin. In practice, about 20-25 confirmations should be enough for reasonably-sized transactions.

Improve this answer
2
  • 4
    Why 20-25? In ethereum.stackexchange.com/a/203/76 Vitalik mentions waiting for 12 confirmations for making "irreversible" changes to data
    – J-B
    Jan 22, 2016 at 5:05
  • 1
    Ethereum doesn't actually implement GHOST; the chain selection rule is the same as Nakamoto. The DAG structure allows paying unintended uncles to demotivate centralization.
    – stanga
    Dec 5, 2018 at 19:28
11

From Vitalik Buterin says in Ethereum blog at 2015/09/14 about the topic of discussing "On Slow and Fast Block Times" https://blog.ethereum.org/2015/09/14/on-slow-and-fast-block-times/

only a small number of extra confirmations (to be precise, around two to five) on the faster chain is required to bridge the gap; hence, the 17-second blockchain will likely require ten confirmations (~three minutes) to achieve a similar degree of security under this probabilistic model to six confirmations (~one hour) on the ten-minute blockchain.

Improve this answer
1
  • From the article, I conclude that it depends on the attack, so the ten confirmations commandment is only valid for the "normal case" not for the Byzantine and the economic attack.
    – Roland Kofler
    Jun 10, 2016 at 15:04
9

I've seen exchanges use 375 confirmations. But as the difficulty increased and the network got more decentralized, it's safe to go way below this.

Of course it depends on how critical the transaction is. As a rule of thumb, wait at least 5 confirmations for amounts higher than $500. Then, add 5 confirmations for each $1000 the transaction is worth.

Improve this answer
5
  • 5
    Is this your personal rule of thumb or some industry wide best practise as promoted by an authorative source (maybe the Ethereum Foundation)? Please clarify the source to improve this answer
    – J-B
    Jan 22, 2016 at 4:57
  • Without diving into the numbers, it does seems sensible to exercise greater cautioun when processing large amounts. But bear in mind that 100 transactions worth $100 each are the same value/risk as one transaction of $10,000, so both situations should be treated with equal caution.
    – joeytwiddle
    May 2, 2018 at 6:21
  • @joeytwiddle: This makes sense, yet there is a difference. 100 transactions worth $100 indeed have a risk of $10000, but the probability that all of them are reverted is strictly lower than the probability of having one $10000 transaction reverted. So technically the risk is lower in this case.
    – Symeof
    Jun 14, 2018 at 10:57
  • @Symeof I agree that's true for normal (expected) reversions. As Roland said in his comment, it really depends on the type of attack you are defending against. I was thinking of an exchange defending against a rare but serious problem, such as a zero day exploit. (The 2016 hard fork reverted ~165 blocks, perhaps informing the 375 limit you quoted.)
    – joeytwiddle
    Jun 16, 2018 at 5:22
  • @joeytwiddle: we agree.
    – Symeof
    Jun 20, 2018 at 10:05
3

I've stumbled upon a very interesting research paper entitled "On the Security and Performance of Proof of Work Blockchains "

the autors state the following :

Due to the smaller block rewards and the higher stale block rate of Ethereum2 compared to Bitcoin (from 0.41% to 6.8% due to the faster confirmation time), Ethereum (block interval between 10 and 20 seconds) needs at least 37 confirmations to match Bitcoin’s security (block interval of 10 minutes on average) with 6 block confirmations against an adversary with 30% of the total mining power.

You'll find the demonstration in the paper

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.