- The paper introduces a smart-contract-level transformation that requires each transaction to pass a Verifiable Delay Function, proving input causality when the delay exceeds the ledger’s liveness parameter.
- The analysis shows that VDFs can prevent unilateral MEV extraction while preserving equilibrium and censorship properties, but coordinated censorship remains a stable strategy for collectively capturing opportunities.
- Benchmarks favor Wesolowski VDFs, with sub-800-millisecond verification and proofs below 516 bytes, while predictable MEV would require per-transaction Proof-of-Work costs near $100, making that extension largely impractical today.
Overview
This paper proposes a defense mechanism against Maximal Extractable Value (MEV) attacks in distributed ledgers, built on a single observation: if a block creator cannot construct a valid transaction quickly enough to react to an MEV opportunity, the opportunity disappears. The mechanism enforces this by requiring every transaction to be evaluated by a Verifiable Delay Function (VDF) before it becomes valid for submission (2608.13271). The authors analyze the resulting transformation in both a Byzantine (cryptographic) model and a game-theoretic model of rational participants, present a negative result showing the defense is not universally stable, extend it with Proof-of-Work to handle predictable MEV opportunities, and evaluate practical feasibility using historical MEV data.
The approach differs from existing countermeasures in that it requires no trusted third parties (unlike MEV auctions and Proposer-Builder Separation), does not attempt general transaction order fairness, and does not hide transaction content from block creators (unlike encrypted-mempool or commit-reveal schemes). Notably, the transformation can be deployed at the smart-contract level rather than requiring changes to the ledger protocol itself.
Model and mechanism
The setting is Canetti-style ITM execution over a synchronous network with a diffuse functionality. Parties hold power shares (hashing power under PoW, stake under PoS), and ledger protocols are assumed to satisfy safety, liveness with parameter T, and a proportionality property: the probability that party Pi produces a block is bounded by its power αi plus a negligible term. This proportionality holds approximately in PoW and Proof-of-Space protocols, and to some extent in PoS — though the paper notes that predictable PoS leader schedules differ qualitatively from PoW in the short term.
The core transformation modifies the ledger's validity predicate. A transformed transaction is a tuple ⟨payload,(vdf,π)⟩ where (vdf,π) is the VDF output and proof on a commitment to the payload. A transaction is valid only if the underlying predicate accepts, the VDF proof verifies, and the commitment opens correctly. Evaluating the VDF on the commitment rather than the payload enables outsourcing the computation without revealing the payload; this relies on modeling the commitment as a random oracle so that VDF sequentiality transfers to the commitment domain.
MEV resilience is formalized as blockchain input causality: no valid adversarial transaction meaningfully depending on an honest transaction can be received by an honest party before that transaction is finalized.
Cryptographic analysis
The central positive result states that if the base protocol guarantees liveness with parameter T and the VDF delay parameter satisfies t>T, then the transformed protocol guarantees input causality with negligible error probability. The proof is by reduction: violating input causality implies violating liveness of the transformed protocol, which in turn implies breaking liveness of the original protocol, since block production probability depends only on party power and not on transaction existence or validity. The binding property of the commitment scheme ensures adversarial VDF evaluations are performed against the actual adversarial payload; notably, the hiding property is not needed for security, only for practical outsourcing.
An important consequence: any live ledger protocol can be made MEV-resilient purely by changing its application-level validity predicate, inheriting all other security guarantees unchanged.
Game-theoretic analysis
Under absolute-reward utilities (fixed block rewards, fees, MEV), the paper proves three results:
- Positive equilibrium: if the base protocol is an ϵ-Nash equilibrium when no MEV opportunities exist, the transformed protocol is an (ϵ+negl)-Nash equilibrium even when they do. Claiming an MEV opportunity requires censoring the target transaction for at least t>T rounds, which a minority-power party cannot achieve.
- Negative equilibrium: there also exists an equilibrium in which all parties censor a high-value transaction for Pi0 rounds and then claim its MEV opportunity collectively. No single party benefits from deviating by publishing the transaction early, since the others censor it regardless. This is a significant caveat: the VDF defense eliminates unilateral MEV extraction but does not preclude coordinated censorship-based extraction as a stable collective strategy.
- Censorship compliance: if the base protocol is Pi1-compliant with respect to censorship in MEV-free executions, the transformed protocol remains compliant even with MEV opportunities, since claiming an opportunity implies breaking liveness unilaterally.
Handling predictable opportunities with Proof-of-Work
The basic scheme fails against adversaries who predict future MEV opportunities: such an adversary can precompute VDF evaluations on front-running transactions at negligible cost and publish them only when a matching honest transaction appears. The paper's enhancement adds two requirements to the validity predicate: a per-transaction Proof-of-Work puzzle (with difficulty Pi2) and a freshness constraint bounding how old the referenced chain element may be (Pi3 rounds).
The enhanced scheme admits a necessary-and-sufficient equilibrium condition: the transformed protocol is an Pi4-Nash equilibrium if and only if, for every transaction, the expected MEV income obtainable within the exploitable window (between Pi5 and Pi6 rounds ahead of broadcast) is less than the per-transaction PoW cost Pi7. This yields an explicit trade-off: higher transaction costs tolerate larger or more predictable MEV opportunities but degrade usability for ordinary users.
Implementation evaluation
VDF candidates. The paper benchmarks Wesolowski's and Pietrzak's VDFs on Bitcoin-like transaction objects. Wesolowski's construction emerges as the clear choice: verification time stays below 800 ms even for computations up to 60 minutes, with proofs consistently under 516 bytes. Pietrzak's verification cost grows logarithmically with computation time (8.09 s verification for 12.36 s computation), making it unsuitable. Recommended delay parameters are roughly twice the confirmation-time safety parameter — about 60 minutes for Bitcoin and 30 minutes for Ethereum. VDF computation can be outsourced via services like OpenSquare, with the commitment-based design preventing the service from learning the payload.
Historical MEV data. Three independent datasets support the claim that most MEV opportunities are small:
| Dataset |
Median MEV |
90th percentile |
Maximum |
| Polygon L2 |
≤ $P_i$8100)</td>
<td>$P_i$9165M</td>
<td></td>
</tr>
<tr>
<td>Arbitrum L2</td>
<td>≤ $\alpha_i$0100)</td>
<td>$100 |
— |
| Optimism L2 |
≤ $\alpha_i$130)</td>
<td>$30 |
— |
| MEV-Boost blocks |
$\alpha_i$2345.34</td>
<td>$3.15M |
|
| Flashbots sandwiches |
$\alpha_i$31,175</td>
<td>$3.3M |
|
| Flashbots arbitrage |
$\alpha_i$44,165</td>
<td>$9.18M |
|
Although tail opportunities reach millions of dollars, the overwhelming majority fall below a few hundred dollars, and claiming them typically requires multiple complex transfers (averaging ~4.78 transfers for arbitrage, ~6.06 for sandwiches). This supports the conclusion that the basic VDF mechanism could realistically prevent most existing MEV threats.
PoW cost feasibility. Here the paper concedes a serious limitation: making the enhanced scheme effective would require per-transaction costs on the order of $\alpha_i$5100 of electricity would need 85–285 hours of operation. The authors state plainly that the enhanced transformation is "mostly theoretical at this point."
Limitations and open questions
The paper identifies several constraints on its own results. First, the negative equilibrium shows coordinated censorship-based MEV extraction remains stable under the basic scheme; the defense guarantees input causality only against unilateral deviations. Second, the freshness-plus-PoW enhancement, while theoretically sound, has no practical parameterization given current hardware economics. Third, usability: imposed delays can worsen DEX arbitrage latency relative to centralized exchanges, cause unnecessary liquidations, and hinder position management — the mechanism suits applications tolerant of delay (e.g., NFT minting) but not price-sensitive ones, and does not address back-running-only attacks. Fourth, VDFs lack rigorous theoretical lower bounds on sequential evaluation, so security rests on empirical estimates of the fastest known implementations rather than concrete hardness assumptions. Finally, alternative delay primitives such as Proof-of-Sequential-Work, which drop output uniqueness in exchange for efficiency, remain unexplored for this application.
Conclusion
This paper demonstrates that enforcing a verifiable delay in transaction generation is a sound and implementable defense against reactive MEV: any live, equilibrium, censorship-compliant ledger protocol can be transformed into one guaranteeing blockchain input causality, with VDF overheads (sub-second verification, sub-kilobyte proofs) compatible with real deployment. Historical MEV distributions indicate the mechanism covers the vast majority of observed opportunities. Its scope is nonetheless bounded: predictable opportunities require a PoW cost mechanism that is currently impractical, coordinated censorship equilibria persist, and applicability is limited to delay-tolerant applications.