0
On GDAX website, they claim that 3 confirmations is needed to finalize your tx in. I assume they've done thorough research on this and might've come up with some logic to protect themselves from temporary branches.
In a few other posts, I often found people say at least 6 is needed. I mean obviously it's trade-off between efficiency and robustness, but just wondering what are some of the possible ways to push this number to the lower end while keeping the system as robust as possible.
2
According to the Bitcoin wiki who refers to this Analysis of hashrate-based double-spending:
No amount of confirmations will reduce the success rate to 0.
If the attacker controls more hashrate than the honest network, no amount of confirmations will reduce the success rate below 100%.
There is nothing special about the default, often-cited figure of 6 confirmations. It was chosen based on the assumption that an attacker is unlikely to amass more than 10% of the hashrate, and that a negligible risk of less than 0.1% is acceptable. Both these figures are arbitrary, however; 6 confirmations are overkill for casual attackers, and at the same time powerless against more dedicated attackers with much more than 10% hashrate.
So as you stated, it is nothing more than a trade-off.
