Overview
A zero-confirmation transaction (also called 0-conf) is a Bitcoin transaction that has been broadcast to the network and propagated through the mempool but has not yet been included in a mined block. Accepting a payment based on a zero-confirmation transaction means trusting that it will eventually be confirmed, without the cryptographic assurance that comes with proof-of-work inclusion.
Risk Assessment
Confirmation Level Security Guarantee
──────────────────────────────────────────
0-conf (mempool) ⚠ Can be double-spent
1 confirmation ■ Included in one block
3 confirmations ■■■ Very unlikely to reverse
6 confirmations ■■■■■■ Practically irreversible
Risk of double-spend attack:
Low-value in-person purchase: Very low risk
Online digital goods: Moderate risk
High-value transactions: Unacceptable risk
When Zero-Conf Is Acceptable
Some merchants accept zero-confirmation transactions in specific scenarios where the risk is manageable:
- Low-value in-person purchases: A coffee shop selling a $5 item faces negligible risk from a double-spend attack, especially since the attacker must be physically present.
- Repeated customers: Established relationships reduce the incentive for fraud.
- Speed requirements: Some use cases (like point-of-sale) cannot wait 10+ minutes for a confirmation.
Double-Spend Risks
A zero-confirmation transaction can be reversed through:
- Replace-by-Fee (RBF): If the transaction signals RBF, the sender can explicitly replace it with a higher-fee transaction that pays a different recipient. Merchants can check for the RBF signal.
- Race attack: The sender broadcasts two conflicting transactions simultaneously, hoping the one paying themselves is mined.
- Finney attack: A miner pre-mines a block containing a double-spend transaction and releases it after receiving goods.
Mitigations
- Check for RBF signaling: Transactions signaling RBF are explicitly replaceable and should not be accepted at zero-conf.
- Monitor for double-spend attempts: Watch for conflicting transactions in the mempool.
- Require sufficient fee rate: Transactions with very low fee rates are more easily replaced.
- Use Lightning: The Lightning Network provides instant settlement finality for small payments, eliminating the need for zero-conf on-chain transactions.
Common Misconceptions
An unconfirmed transaction is not the same as an invalid transaction. Zero-confirmation transactions have been validated by nodes and are likely to be mined — the question is whether they will be mined before a conflicting transaction. The risk is probabilistic, not binary.