Censorship-Resistant Sealed-Bid Auctions on Blockchains

Abstract: Auctions are now central to blockchain markets, settling NFT sales, token launches, DeFi liquidations, and arbitrage opportunities. Each on-chain bid is a public transaction whose inclusion is decided by a single consensus proposer per block. The proposer can observe pending bids, exclude competitors, and submit bids of their own, breaking the fairness guarantees of classical sealed-bid auctions. To enable latency-sensitive sealed-bid auctions in blockchain settings, we formalize four properties -- each necessary to prevent a concrete attack -- and design a protocol achieving all four: hiding bid contents, existence, and bidder identity until reveal (Hiding); counting all timely honest bids and rejecting late adversarial bids (Simultaneous Release); preventing silent withdrawal of committed bids (No Free Bid Withdrawal); and charging on-chain fees only to winners (Auction Participation Efficiency). Our protocol uses a timestamping oracle (instantiated with a committee of 2f_ts+1 timestampers) and a censorship-resistant inclusion predicate (instantiated using a FOCIL-based inclusion list), with only the winning bid settled on-chain. Our construction relies on two zero-knowledge proofs: an eligibility proof that anonymously proves deposit membership to the timestamping committee, and an auction proof that binds a bid to a specific auction for the inclusion list committee. We implement both using Groth16 over BN254 with Poseidon hashing in arkworks/Rust: the auction proof generates in 13 ms and verifies in under 1 ms; eligibility proofs for Merkle trees up to 2^32 bidders generate in 47-159 ms and verify in about 1 ms. Together, this yields a sealed-bid auction primitive practical for high-value, time-sensitive blockchain settings.

• The paper introduces a protocol ensuring censorship resistance and bid privacy by using timestamp oracles and zero-knowledge proofs.
• It employs a two-phase auction process with deposit penalties to secure bid commitments and exclude late or adversarial bids.
• Experimental benchmarks demonstrate sub-15ms auction proof generation and scalable eligibility verification for efficient blockchain auctions.

Censorship-Resistant Sealed-Bid Auctions on Blockchains

Motivation and Problem Formulation

This paper examines the shortcomings of sealed-bid auctions implemented directly on blockchain platforms, which are increasingly used for NFTs, DeFi liquidations, token launches, and blockspace. In these settings, each on-chain bid is a public transaction whose inclusion is determined by a single consensus proposer per block. This exposes several severe vulnerabilities: proposers have full visibility into the mempool, can censor competitor bids, and are empowered to strategically insert their own bids with a latency advantage, undermining auction fairness and enabling MEV extraction.

The authors formalize four essential properties required for sealed-bid auctions in adversarial blockchain environments:

• Hiding: Bid values, their existence, and bidder identities remain confidential until the reveal phase.
• Simultaneous Release: All honest, timely bids are counted and late bids are excluded, blocking last-look and censoring strategies.
• No Free Bid Withdrawal: Submitted bids cannot be silently withdrawn without cost, preventing free-option and abort-after-reveal attacks characteristic of commit-and-reveal schemes.
• Auction Participation Efficiency (APE): Fees are imposed only on winners; losing bidders should not pay on-chain inclusion costs, restoring classical strategic and payoff dynamics.

None of the existing blockchain auction protocols achieve all four properties simultaneously. Prior solutions only address subsets, are vulnerable to censorship, incur unnecessary fees, or leak bid information.

Protocol Design and Formal Characterizations

The protocol proposed by the authors leverages two modular primitives—a timestamping oracle and a censorship-resistant inclusion predicate instantiated with a committee-based FOCIL mechanism. The protocol is structured into preparatory phases (auction and user registration with deposits) and two per-auction phases (bid timestamping and bid reveal/submission).

• Registration: The auctioneer initializes auction parameters on-chain, establishing uniqueness and slot reservation.
• User Deposit: Users lock a one-time deposit, serving both as eligibility and a penalty mechanism for bid withdrawal, with deposit state managed via a Merkle tree.
• Timestamping (Phase 1): Users anonymously broadcast bid commitments accompanied by zero-knowledge membership proofs to timestampers, aggregating responses into a certificate. Winning bids are hidden pre-reveal and existence is obfuscated across active auctions and registered users.
• Bid Submission (Phase 2): Users submit revealed bids with timestamp certificates to the inclusion list committee; only timely, valid bids are considered. All but the winning bid remain off-chain, minimizing settlement costs.

The protocol uses Groth16 with Poseidon hashing for ZK proofs, offering strong anonymity and bid commitment security without threshold encryption. The auction proof generates in 13 ms and verifies in less than 1 ms; eligibility proofs for up to $2^{32}$ users generate in under 160 ms and verify in 1 ms, demonstrating scalability and feasibility for time-sensitive, high-value applications.

Security Properties and Analysis

The authors rigorously define and prove attainment of their four targeted properties. Key elements include:

• Strengthened Hiding: The definition encompasses value indistinguishability, existential obfuscation within the set of active auctions, and user anonymity among registered bidders—each parameterized by the number of parallel auctions and users, with stronger guarantees in overlapping settings.
• Simultaneous Release: The property is formulated as $(\delta_i, \delta_e)$-censorship resistance, meaning all honest bids arriving $\delta_i$ before the deadline are included, and adversarial bids submitted more than $\delta_e$ after the deadline are excluded. Network and clock-bound delays are tightly integrated into the formal guarantees.
• No Free Bid Withdrawal: Withdrawal is prevented by the deposit mechanism combined with uniqueness of bid handles per deposit and auction. If a committed bid is not revealed, the deposit is forfeited, closing the free option loophole.
• APE: Only winning bids incur on-chain cost; losing bidders pay nothing beyond amortized deposit costs, restoring traditional auction equilibria and promoting participation.

The protocol's security model assumes synchrony in the network and clocks, static corruption bounds in timestamping and IL committees, and existential honesty in IL proposers, aligning model assumptions with realistic constraints in consensus and committee-based designs.

Benchmarks and Implementation Results

Empirical evaluation demonstrates that both eligibility and auction proofs are computationally efficient: auction proofs require about 13 ms for generation and 1 ms for verification, while eligibility proofs scale logarithmically with the number of bidders (46–159 ms for generation, ~1 ms verification for $2^8$ to $2^{32}$ bidders). The implementation in Rust (arkworks) confirms the protocol is practical for blockchain environments with slot durations of 12 seconds (as on Ethereum). The scheme maintains off-chain scalability, with only the winning bid settled and minimal on-chain interaction for deposits.

Comparative Analysis and Related Work

The authors present a comprehensive comparison with prior sealed-bid auction protocols and privacy-preserving mechanisms, including commit-and-reveal, cryptographic approaches, off-chain auction platforms, and protocol-level inclusion list designs (FOCIL, AUCIL, MCP). Prior work fails to realize all four properties simultaneously or relies on trusted third parties, threshold encryption, or incurs participation fees for losing bidders. The proposed design uniquely achieves comprehensive censorship resistance, strong hiding (including existential and user obfuscation), no free withdrawal, and auction participation efficiency, mostly operating consensus-adjacent and avoiding full protocol modifications.

Threshold encryption, encrypted mempools, and off-chain order books (e.g., OpenSea, CoW Protocol, Flashbots/MEV-Boost) enhance privacy at the expense of increased trust assumptions or vulnerability to latency and censorship attacks. The proposed timestamping oracle and IL mechanism minimize these risks, avoiding privacy breaches under committee collusion, and degrade only to denial-of-service.

Limitations and Future Work

The protocol's reliance on honest-majority timestampers and existentially honest IL proposers presents incentives challenges, currently unaddressed. Practical instantiations of anonymous broadcast channels with provable latency bounds remain an open problem; designs trade off between hiding and timely bid inclusion. Further, auctioneer Sybil resistance and slot reservation mechanisms are outstanding, as are fee designs to deter low-value auction spam. A detailed economic analysis to optimize deposit sizes, penalties, and inclusion/incentive rules for timestampers and block proposers is needed.

Theoretical and Practical Implications

The protocol recovers the ideal strategic scenario assumed in classical auction theory (Vickrey, Myerson, Riley-Samuelson, Krishna), enabling accurate equilibrium and revenue analysis conditional on value environment assumptions. By separating off-chain bid creation and inclusion enforcement from on-chain settlement, it aligns blockchain auction economics with classical models, facilitates MEV mitigation, and enables practical, high-throughput deployment for latency-sensitive DeFi, NFT, and blockspace sales.

The design suggests future research directions in incentive-compatible timestamping, committee-based inclusion lists under rational adversaries, and robust anonymous communication over blockchain networks. Further exploration into auction mechanism implementation, especially under asynchronous networks or adversarial environments, remains critical.

Conclusion

The paper presents a technically rigorous construction for censorship-resistant, sealed-bid auctions on blockchains, addressing both adversarial proposers and efficiency concerns. The protocol is modular, scalable, and achieves formal security and economic properties previously unattainable in blockchain auction settings. It establishes a foundation for deploying fair, efficient, and privacy-preserving market primitives in decentralized systems, and opens avenues for advancing protocol-level censorship resistance, anonymous communication, and incentive engineering in permissionless environments (2606.14939).