Child transaction cancellation using replace by fee

[eug13768]

The method is perfectly described here (although in Russian): https://bitnovosti.com/2017/03/22/how-to-safely-buy-hold-and-sell-btc/ - works until 1st confirmation received.

Steps to reproduce:

1. Сreate transaction with a fee small enough so that it could stay in mempool forever. The transaction output must point to one of owner's addresses. Set RBP when creating.
2. Create child transaction with input taken from fee address of 1st transaction. This is the transaction that will be shown to a victim.
3. Now both transactions stay in mempool without any confirmations for indefinite time
4. It works until 1st confirmation so it's time to show child transaction to a victim merchant to get some goods or services from him - if he does not care to wait for confirmation(s).
5. When goods are taken, let's go and create new transaction instead of 1st one (parent) by just increasing fee up to high enough. This way transaction Setup wizard on first run #1 and it's child Unobtrusive server handling #2 will show disappeared from mempool and new transaction Binaries for all operating systems #3 (still pointed to one of the attacker's addresses) with high enough fee will start getting confirmations.

Result: Child (#2) showed as payment transaction disappeared, although goods and/or services might be already taken by the attacker from trustful merchant.

Proposal: Mark the transaction on blockchain in case there is unconfirmed parent transaction.

[ecdsa]

this is normal; it's a feature of Bitcoin, not of Electrum.
This is why the GUI warns you about "unconfirmed parents"

[eug13768]

Mycelium mark such child transaction on blockchain so that merchant could see its in RED.

[ecdsa]

"on blockchain" ? what does that even mean?