Transaction receipts, blocks and confirmations

Question

In Bitcoin, there is a best practice to wait between three to six block confirmations before accepting an transaction. This is to avoid double spending. Are there similar rules of thumb in Ethereum?

Let's assume I am building a service that tracks Ethereum payment transactions. If I have an incoming tx hash, how can I check confirmations over Geth RPC API? I assume the transaction receipt should be used, but what numbers I should track to watch out for double spends and similar things. Is a transaction somehow invalidated if a double spend or other malign condition (fork?) is detected?

Answer 1

Here are the answers to the 3 questions on confirmations, checking for confirmations, and double spends.

---

1. What number of confirmations is considered secure in Ethereum?

12 confirmations; however, exchanges and entities handling very large amounts of Ether frequently are still encouraged to run two different Ethereum implementations and only accept transactions that have been confirmed by both for maximum security (e.g. Go & C++).

---

2. Indeed, using the transaction receipt is a way to check confirmations. Code example at: How can a DApp detect a fork or chain reorganization using web3.js or additional libraries?

---

3. Double spends are prevented because every account has a transaction count (nonce) that increases with each transaction.

Note: although each account has a nonce which prevents double spends, the nonce does not protect against replay attacks.