Allow spending zero confirmation UTXO

[slush0]

Hi,

please allow to spend unconfirmed transactions, as is usual in another bitcoin wallets. This is especially useful for mobile application like Mycelium, where transactions are done face-to-face and waiting for confirmations is extremely inconvenient.

I'm especially interested in the possibility of spending unconfirmed tx from cold storage / paper wallet.

I'm willing to pay a bounty of 1BTC for implementing / integrating this feature into Mycelium.

[janmoller]

Hi Slush.
Spending general unconfirmed transactions is by no means common in wallets. Can you tell me which wallets support this?
(Yes, I know I don't have to lecture you on how stuff works... but you asked)
Spending unconfirmed change-sent-to-self is common, but as long as we have malleability even this is not 100% safe, but we allow it non the less as a last resort when you have no other unconfirmed outputs.

We could enable spending unconfirmed from cold storage, but is it really the use case any different from spending unconfirmed from 'normal' wallets?

[slush0]

Well, I just made a research and I'm surprised that it's not so often than I expected. However, at least Electrum and myTREZOR do zero conf spends :-).

Technically the risk is negliable, because anybody who receives zero confirmation tx must understand its downsides anyway; it actually does not matter much if such 0conf tx is built from confirmed utxo or unconfirmed utxo. And the advantage is obvious. I gave few bitcoins to my friend in a bar and he wanted to directly spend them for a beer, but it wasn't working. So we waited ~15 minutes at a bar without any drink :-).

Aside of common problem described above, I initiated this issue / feature request because of one very specific use case. In few days we're opening Bitcoin café in Prague, as a part of bigger project called Paralelni polis (http://www.paralelnipolis.cz/en/). Everything in this building can be purchased only by bitcoin, no fiat. However for those people, who don't have any bitcoin wallet yet or they don't have smartphones, we'll print paper wallets and charge them with bitcoins. Then we need to be able to spend these coins immediately, using Cold wallet feature of Mycelium. Operator just scans the private QR code, spend coins for the purchase and returns change back to the paper wallet. Of course this requires some trust, but paper wallets will contain just spare money for coffee and some snack, and operators of Paralelni polis are trusted entities.

It would be awesome to be able to spend zero conf from Cold storage, because we like Mycelium as a mobile payment solution and we also would like to propagate Mycelium as a solution for bitcoin beginners.

Thank you for considering this feature :-).

[slush0]

Ping

[janmoller]

sorry, passed out this weekend due to the "single malt effect" :-)

We don't really want our users to have to understand the risks of accepting zero conf transactions which is why we don't allow spending unconfirmed outputs.

The risk is very real. During the big malleability attack some time last february a notable percentage of the transactions that were confirmed were actually mutated versions that eventually got confirmed. (don't remember the details, but I made an analysis based on what the 1000 nodes I observed back then broadcasted). If you spend the output of the wrong version of a mutated transaction (the version that didn't confirm), then your transaction will be invalid. When this happens the blame will go to us, the developers of a "crappy product that cannot even make simple transactions right"
Have in mind that mounting a malleability attack is very cheap.

All that said, we could add a setting that allows users to go ahead and spend unconfirmed stuff with a fair warning.

[slush0]

All that said, we could add a setting that allows users to go ahead and spend unconfirmed stuff with a fair warning.

What would be awesome. I'm not sure how much work this requires, but I'd need that feature this Thursday :-)).

[janmoller]

haha... must be kidding me. Seriously, we cannot make the change this quickly.

[slush0]

Actually I'm not kidding, I really need some solution this week. Unfortunately it seems that I need to find some other solution in meantime.

The risk is very real.

The risk is not higher than just accepting unconfirmed transactions. Operators of POS won't wait for confirmations either, even if you don't allow them to directly spend such transactions.

[jandreske]

Since it will be your personnel, not the customers needing to do 0 conf cold spending (if I got this right), would it be in theory helpful for you to just get a custom .apk to put on the phones? It would not come via play store etc, but having someone make this code change for you outside of the official release cycle seems like a quick solution until its maybe integrated in the official release later.

[slush0]

Yes, we're talking about two mobile devices which need to be able to spend zero confirmation utxo from cold storage...

1 BTC bounty is still available.

[jandreske]

You will get an apk being able to do that. :)

[janmoller]

The risk is not higher than just accepting unconfirmed transactions.
But it is. When accepting unconfirmed transactions it doesn't matter if the transaction is malled. It is still a valid transaction, and will confirm at the same pace as the original.
On the other hand, when spending an unconfirmed transaction your new transaction depends on a parent transaction which might get confirmed in a mutated version. When this happens your new transaction will be rejected.

We expect to send out Mycelium 2.0 today, and it will allow spending unconfirmed outputs, but only for Cold Storage spending. The release will be in stages over a few days, but we will also provide a direct download link for the eager. If you hit About in the menu there is a Donate button. When you have verified the change and if you are happy about it you can send the bounty reward there :-)

[apetersson]

take a look at http://mycelium.com/bitcoinwallet where we provide a direct download link. it includes the ability to spend 0-conf outputs when doing cold storage spending. please TEST it :) see https://github.com/mycelium-com/wallet/releases/tag/v2.0.0

[slush0]

Jan, Andreas, thank you very much, I'll give it a try today :-)

[johnzweng]

Compiled from "master" branch 5 minutes ago (db445a5) and works prefectly for me on testnet. :-)

[janmoller]

thanks johnny

[slush0]

Everything is working well and our setup using Piper / ATM / Mycelium was a great success. If you'll be in Prague, don't hesitate to visit Bitcoin Café in Paralelni Polis (https://www.facebook.com/pages/Paraleln%C3%AD-Polis/690647371027036) to check it out by yourself!

I don't have Android phone here, so Jan / Andreas, can you post address for donation here?

[jandreske]

Sure : 13YxhmcAyr9W1frumWr3trXLAj2hSHWBmo

-------- Ursprüngliche Nachricht --------

Von: slush0 notifications@github.com

Datum:16.10.2014 19:17 (GMT+01:00)

An: mycelium-com/wallet wallet@noreply.github.com

Cc: Jan Dreske jandreske@web.de

Betreff: Re: [wallet] Allow spending zero confirmation UTXO (#116)

Everything is working well and our setup with Piper / ATM / Mycelium is a great success. If you'll be in Prague, don't hesitate to visit Bitcoin Café in Paralelni Polis (https://www.facebook.com/pages/Paraleln%C3%AD-Polis/690647371027036) to check it out!

I don't have Android phone here, so Jan / Andreas, can you post address for donation here?

—
Reply to this email directly or view it on GitHub.

[aussiehash]

Off topic, slush, have you been able to install python-Trezor on Piper ?

On 17/10/2014, at 4:17 AM, slush0 notifications@github.com wrote:

Everything is working well and our setup with Piper / ATM / Mycelium is a great success. If you'll be in Prague, don't hesitate to visit Bitcoin Café in Paralelni Polis (https://www.facebook.com/pages/Paraleln%C3%AD-Polis/690647371027036) to check it out!

I don't have Android phone here, so Jan / Andreas, can you post address for donation here?

—
Reply to this email directly or view it on GitHub.

[slush0]

@aussiehash Didn't tried that. Actually I just ordered Piper for Parallel Polis and I didn't have time to play with that at all. If you have more question, please email me to slush@satoshilabs.com.

[slush0]

@jandreske Sent in b976506f2ff73390fda1e3629cdb5b2d6aaa488518e96f509d790b81629de7e0

Thanks again for quick solution of this feature request, we're happy users of Mycelium in PP café now.

During last week we have tens of face-to-face bitcoin payments per day and I'm pretty sure that Parallel Polis is turning to be a place with the most frequent brick'n'mortar bitcoin payments around the world, and first real stress test for bitcoin infrastructure like POS and mobile wallets.

Because of this, and thanks to our experience so far, I just want to ask you again to reconsider spending zero-conf UTXO in Mycelium wallet as well (not only in Cold storage). It is highly inconvenient to wait for confirmation, when you know that you just received money from your good friend which is not going to scam you. I think removing such strict rule for confirmations and adding some "soft" human-understandable warning when you're receiving tx made of UTXO would be ideal. That would make our life much easier. Thanks!

[prusnak]

@slush0 please reopen, not sure why this is closed. There is a demand for this feature (not by default, but activated in user's settings).

[slush0]

Agree. I'm writing long letter to wallet developers explaining why blocking of unconfirmed utxo has no sense, and offering better solution of malleability issue.

I've discussed this with Alex in Sofia and he seemed interested in the proposal.

[jandreske]

Yes, Alex already told me he had some nice discussions with you :) I am curious looking forward to the long letter :)

[dessalines]

I need this feature baadly. The mycelium testnet wallet is useless today because testnet3 has reset, and everything is 0 confirmations.

[DanielWeigl]

Current beta has it enabled, will get released within next week