In Bitcoin, 6 confirmations are considered secure (very low probability of transaction/block reversal).

What is the current number in Ethereum?

  • 1
    Eth, you are talking about confirming a block here, right? I ask because of the comment lungj made to my question here: ethereum.stackexchange.com/questions/21686/… - Your clarification, would be great. – Tesa Jul 27 '17 at 22:48
  • @Tesa I understand the terminology isn't great. You would say a transaction has 6 confirmations; but we don't really say that blocks get confirmed and it's unusual to say that a block has 6 confirmations. A well-written definition from Bitcoin: "confirmations represent the number of blocks in the block chain that have been accepted by the network since the block that includes the transaction." (When we get to Proof of Stake, there are notions of blocks getting finalized.) – eth Aug 10 '17 at 6:09
up vote 34 down vote accepted

From George Hallam:

12 confirmations; however, exchanges and entities handling very large amounts of Ether frequently are still encouraged to run two different Ethereum implementations and only accept transactions that have been confirmed by both for maximum security (e.g. Go & C++).

For reference, 12 confirmations is approximately 3 minutes.

  • 2
    Can you please provide a reference to why 12 confirmations is a good number? – Moe Elsharif Jan 9 at 10:43

The geth client waits 5 blocks for confirmation of fresh minted blocks (around 1 minute).

I0201 19:07:07.354260    9098 worker.go:349] 🔨  Mined block (#1483 / a2648b58). Wait 5 blocks for confirmation

To make sure a block is no uncle or a transaction included in a block does not hang up in an ommer, I would suggest waiting 7 confirmations (around 2 minutes). From the whitepaper:

An uncle included in block B must have the following properties: [...] It must be a direct child of the kth generation ancestor of B, where 2 <= k <= 7. [...]

Miners need to check the parameters of the last 250 blocks. If you want to be on the most secure chain, with all feet on the ground, do it like the miners and wait for 250 confirmations (around 1 hour).

Some exchanges practice a double-all-in and even wait for 500 confirmations (about 2 hours). This might come along with the security warning that is readable everywhere because frontier is still not considered to be stable. I guess that's overkill.

To sum up, it always depends on your application and the attached value to consider which number of confirmations is considered to be secure.

Ethereum theoretically approaches finality in less time than Bitcoin, due to the GHOST protocol. This means that, with a 15 second block time, roughly 40 blocks are needed to match the 60 minutes that 6 Bitcoin blocks takes.

Therefore, assuming no major consensus bugs, 40 confirmations should be more secure than 6 confirmations in bitcoin. In practice, about 20-25 confirmations should be enough for reasonably-sized transactions.

From Vitalik Buterin says in Ethereum blog at 2015/09/14 about the topic of discussing "On Slow and Fast Block Times" https://blog.ethereum.org/2015/09/14/on-slow-and-fast-block-times/

only a small number of extra confirmations (to be precise, around two to five) on the faster chain is required to bridge the gap; hence, the 17-second blockchain will likely require ten confirmations (~three minutes) to achieve a similar degree of security under this probabilistic model to six confirmations (~one hour) on the ten-minute blockchain.

  • From the article, I conclude that it depends on the attack, so the ten confirmations commandment is only valid for the "normal case" not for the Byzantine and the economic attack. – Roland Kofler Jun 10 '16 at 15:04

I've seen exchanges use 375 confirmations. But as the difficulty increased and the network got more decentralized, it's safe to go way below this.

Of course it depends on how critical the transaction is. As a rule of thumb, wait at least 5 confirmations for amounts higher than $500. Then, add 5 confirmations for each $1000 the transaction is worth.

  • 4
    Is this your personal rule of thumb or some industry wide best practise as promoted by an authorative source (maybe the Ethereum Foundation)? Please clarify the source to improve this answer – Joris Bontje Jan 22 '16 at 4:57
  • Without diving into the numbers, it does seems sensible to exercise greater cautioun when processing large amounts. But bear in mind that 100 transactions worth $100 each are the same value/risk as one transaction of $10,000, so both situations should be treated with equal caution. – joeytwiddle May 2 at 6:21
  • @joeytwiddle: This makes sense, yet there is a difference. 100 transactions worth $100 indeed have a risk of $10000, but the probability that all of them are reverted is strictly lower than the probability of having one $10000 transaction reverted. So technically the risk is lower in this case. – Symeof Jun 14 at 10:57
  • @Symeof I agree that's true for normal (expected) reversions. As Roland said in his comment, it really depends on the type of attack you are defending against. I was thinking of an exchange defending against a rare but serious problem, such as a zero day exploit. (The 2016 hard fork reverted ~165 blocks, perhaps informing the 375 limit you quoted.) – joeytwiddle Jun 16 at 5:22
  • @joeytwiddle: we agree. – Symeof Jun 20 at 10:05

protected by Community Apr 13 at 21:54

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.