"Reorgs" and Associated Risks

Transactions in a blockchain are packaged into blocks. Different blockchains have different rules for how to decide which transactions get packaged into a block, but they often include rules for invalidating recently generated blocks.

This rewrite of history is called a "reorganization" ("reorg" for short) and invalidates any transactions included in the invalidated blocks, thus returning any transferred funds to their original owners.

Such events can represent a security risk, because an attacker could use a cryptocurrency transfer as payment for a good or service, and subsequently trigger a reorg, thus invalidating his transfer (and getting his cryptocurrency back) while keeping the good or service he paid for. Cryptocurrency exchanges have lost hundreds of millions of dollars in such attacks (often referred to as "51% attacks" after a particular methodology).

Confirmations

To protect yourself against reorg attacks, you can wait for a number of blocks before recognizing a transfer. As more blocks are processed after a given block, the difficulty with which that block may be invalidated increases. Therefore, by choosing how many blocks to wait before recognizing a transfer, a receiver is able to balance speed (waiting very few blocks in order to process the transfer quickly while taking on risk of losing money due to a reorg) and security (waiting more blocks to minimize the risk of a reorg at the cost of slower transfer processing).

The number of blocks you wait before considering a transfer valid is called the "confirmation number", which is typically different for different chains. iPeakoin APIs use the following confirmation numbers for each supported chain.

Confirmations and Transfer Status

As soon as an incoming transfer is included in a block, the API will make it available for you (whether you poll the get transfers endpoint or subscribe to notifications). However, the transfer will have a running status and it will not credit the balance of the associated hosted wallet with the transfer amount until the required number of confirmations has been reached.

At that point the transfer status will change to completed. If you have subscribed to notifications, you will receive a message indicating such status change.

You might want to deem an incoming transfer completed before such a status change and fulfill your business process that depends on that transfer. But note that you will be doing so at your own risk, as you might never actually receive the funds in case there is a reorg before the number of confirmations has been reached.