What Is the Risk of Accepting a Transaction with Zero Confirmations?
The primary risk is a double-spend attack. With zero confirmations, the transaction is only in the memory pool (mempool) and has not been included in a block.
An attacker could broadcast a conflicting transaction with a higher fee to a miner, which could be included in the next block, invalidating the original transaction.
