Double-spending can reduce the computational efficiency of a blockchain, decrease transparency, and affect users’ assets. So, what is double spending?
What is Double Spending?
Double-spending is the risk of spending the same funds twice on a blockchain network. An attacker uses a single source of funds for two or more transactions. The goal of exploiting double-spending is to profit from buying goods, services, or assets without actually depleting their original funds.
However, to exploit the double-spending vulnerability, the attacker must be a node, miner, or validator with the power to participate in validating their own transactions. They might even need to possess over 51% of the network’s computing power to write malicious transactions to the blockchain. Therefore, double-spending rarely occurs in the crypto market and has almost never happened on major blockchains.
Double-spending is one of the first problems that all developers need to address when they start building and developing a blockchain. This is because double-spending is considered a vulnerability that affects the transparency of the network, users’ assets, and even the token value of projects.
Read more: What is Crypto Mining? 4 Tips for Effective Crypto Mining
How Does Double Spending Occur?
Double-spending is a common vulnerability in online transactions that rely on electronic technology, so the crypto market is no exception to double-spending errors.
Typically, double-spending occurs during the pending confirmation period of transactions and the block creation time of the blockchain.
Suppose A is the person carrying out the double-spending attack. A will play two roles: the transactor and a node validating transactions on the network.
The process is as follows:
- A creates and signs the initial transaction, specifying the amount and the recipient.
- A broadcasts the initial transaction version to the nodes in the blockchain network.
- The nodes in the network receive and confirm the initial transaction.
- During the transaction confirmation process, A creates a different version of the transaction with the same amount but with different transaction data.
- A continues to broadcast the second transaction version to the nodes in the blockchain network.
- The nodes receive the second transaction and confirm it.
- The initial transaction and the second transaction coexist in the blockchain network and are confirmed by some nodes in the network. The inconsistency in transaction information creates confusion in the system.
However, blockchain technology uses control and validation mechanisms through consensus algorithms such as Proof of Work, which nodes must adhere to in order to write new blocks to the network. This is to prevent and detect double-spending transactions, making it difficult and costly for attackers to carry out double-spending attacks.
On some large blockchains like Bitcoin, the network typically has a transaction re-check (reorg) feature. Therefore, invalid transactions will be rejected after a maximum of 6 blocks.
Double-spending can occur if and only if the attacker has the authority to validate transactions like other miners and also has more than 51% of the computing power of the entire network. In this case, the attacker will have the right to validate all incorrect transactions as valid and even “print” tokens through double-spending.
But if the attacker’s computing power is not strong enough, their transactions will be removed from the blockchain within minutes or even seconds
Example: In the Bitcoin network, a transaction is always confirmed within 6 blocks. If miners detect a duplicate or erroneous transaction, the 6 most recent blocks will be deleted. However, if an individual or organization has significant computing power, they could potentially calculate 6 consecutive blocks, allowing them to make incorrect transactions appear valid.
However, achieving 51% of the network’s computing power requires a lot of resources and is very costly. Moreover, if a double-spending attack is successful, the network loses its security and transparency, and any additionally printed tokens will have no value. This means that the attacker would have to spend a lot of money without gaining any profit from the network.
In reality, this form of attack is considered by the community to be a theoretical and ideal type of double-spending for attackers, as they need to have more than half the computing power of all other miners combined.
Double-spending can also occur due to design flaws in smart contracts, allowing users to spend the same token twice.
Bitcoin’s Double-Spending Prevention Mechanism
Bitcoin was the first blockchain to prevent double-spending, and its mechanism is still widely adopted by many blockchains today. First, when a user creates a transaction, it is in an “unconfirmed” state and will not be included in a Bitcoin block.
If an “unconfirmed” transaction is included in a block, it will be validated by the Bitcoin network within 6 blocks. During this time, if the transaction is confirmed to be correct and there is no double-spending, it will be written to the public ledger and sent to the miners and the recipient in encrypted form using cryptography.
Bitcoin, being the largest network in the crypto market, is naturally a prime target for double-spending attacks. If the network, with a market capitalization of over $600 billion, were to experience a successful double-spending attack, the consequences would extend far beyond Bitcoin itself, potentially leading to the collapse of the entire crypto ecosystem.
Types of Attacks that Cause Double Spending
51% Attack
A 51% attack is a type of attack carried out by an individual or organization when they control 51% of a blockchain’s computing power. If the attacker has 51% of the computing power, they can freely validate, block, and manipulate transactions on the network. This makes double-spending vulnerabilities easier to exploit.
For example, when an attacker performs a 51% attack, they can create multiple transactions with the same source of funds, and these transactions are all validated and added to blocks by them. This leads to a situation where the transactions are established and considered valid by the network, but the attacker’s assets do not disappear.
However, due to the scale of the attack requiring a large amount of resources and being difficult to execute, 51% attacks usually only occur on smaller blockchains with fewer miners. In January 2020, the Bitcoin Gold blockchain fell victim to a 51% attack, where the attacker exploited double-spending and profited by $70,000.
Race Attack
A race attack is a form of attack that exploits the double-spending vulnerability. The attacker creates an initial unconfirmed transaction with the victim. Simultaneously, the attacker creates a second transaction that “overrides” the first, aiming to gain validation from the network. As a result, the attacker’s first transaction with the victim fails, but the second transaction succeeds.
This leads the victim to believe they have been paid and provide services to the attacker, but in reality, the attacker has not transferred any funds to the victim.
Finney Attack
A Finney attack is a type of attack by a miner where they can create a block containing a fraudulent transaction. At the same time, they create a transaction with the same cryptocurrency and send it to a real user. If this user accepts the transaction, the miner will add the block containing the fraudulent transaction to the blockchain network. This causes the fraudulent transaction to be validated, and the second transaction is rejected.
The Finney attack was conceived by Hal Finney, the first person to validate a block on the Bitcoin network. However, he believed that the Finney attack was just a theoretical attack idea and not practical, as it requires the attacker to have a stroke of luck in finding a block containing a real transaction to replace with a block containing a fraudulent transaction.
Preventing Double Spending
For large blockchains, preventing double-spending depends on network security factors such as smart contracts, cryptography, and consensus mechanisms. But for ordinary users, how can they prevent double-spending?
In the examples above, you can see that most sellers accept “unconfirmed” transactions, resulting in them being scammed and not receiving payment. Therefore, to prevent double-spending, users should only accept transactions that are marked as “confirmed.”
Currently, wallets like Coin98 Wallet, Trust Wallet, and even centralized exchanges like OKX and Binance always label transactions that are “unconfirmed” to warn users.
Some Questions About Double Spending
Is Double Spending Common?
Currently, double-spending mainly occurs on smaller blockchains with weaker defenses against 51% attacks and race attacks. On larger blockchains like Bitcoin or Ethereum, the likelihood of double-spending is very low, or it may never happen at all.
How Can Users Prevent Double Spending?
Generally, users should only accept transactions that have been confirmed by the network. For example, on the Bitcoin network, users should wait for at least 6 confirmation blocks (blocks validated by miners), or on the Polygon network, at least 128 confirmation blocks are needed. The longer you wait to accept a transaction, the less likely double-spending is to occur.
