Randomized Transaction Ordering

• Randomized transaction ordering is a mechanism that leverages randomness to determine transaction sequence, mitigating front-running and other economic vulnerabilities.
• It encompasses designs such as power-weighted lotteries and commit-reveal schemes, balancing technical feasibility with market fairness and security.
• The approach impacts blockchain scalability and MEV resistance, bridging stateful execution, order validity, and economic control in distributed ledgers.

Randomized transaction ordering denotes a family of protocol mechanisms in which transaction position is determined, wholly or partly, by randomness or by protocol-generated unpredictability rather than by a fixed proposer sequence, pure fee priority, or first-seen order. In recent research, the concept appears in several distinct forms: direct intra-block permutation, power-weighted randomized lotteries, and randomized reveal order in commit-reveal protocols. It is also defined by contrast with deterministic fair-ordering systems and with architectures that avoid global ordering altogether. Across these lines of work, transaction order is treated not merely as a serialization artifact, but as a source of MEV or BEV, a determinant of execution validity, and an economic control variable for price formation and welfare (Droll, 29 Sep 2025, Chen et al., 13 Jul 2026, Lee et al., 4 Apr 2025).

1. Ordering as a security and economic primitive

Transaction ordering is economically consequential whenever execution is stateful and order-sensitive. In DeFi, front-running, back-running, sandwich attacks, arbitrage MEV, and liquidation MEV all exploit the fact that pending transactions are visible before execution and that their relative placement affects outcomes. Masquerade frames the problem as one in which miners, bots, and validators can reorder visible pending transactions and reap Maximal Extractable Value, while PRECEDE argues that the deeper issue is causality: if an attacker observes a user transaction and then submits a competing one, the user’s transaction should precede the attacker’s, yet that causal relation is private to the attacker (Vedula et al., 2023, Chen et al., 13 Jul 2026).

The same dependence appears in DAG-based systems. Tilikum emphasizes that DAGs are not automatically “fair” just because they are fast. In its formulation, the decoupling of dissemination from ordering leaves room for DAG-specific reordering attacks, including fissure, sluggish, and speculative attacks on Narwhal/Tusk. This places fair ordering at the center of BEV resistance rather than treating high throughput as sufficient protection (Segalini et al., 25 Jun 2026).

AMM research makes the economic content of ordering especially explicit. In a constant-product market maker with invariant

$k = x_t y_t$

and spot price

$p_t = \frac{y_t}{x_t},$

the execution price of each trade depends on preceding trades. CLVR therefore studies transaction ordering as a permutation problem over pending trades, with a volatility objective

$$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$

and a post-trade Gini objective

$$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$

Its main conclusion is that minimizing volatility and minimizing inequality are generally different ordering objectives, so sequencing policy directly encodes a welfare criterion (McLaughlin et al., 2024).

A common misconception is that ordering questions are exhausted by consensus safety. The literature instead treats ordering as a separate design surface spanning adversarial robustness, mechanism design, market quality, and deployability.

2. Explicit randomized ordering mechanisms

The most direct randomized ordering rule in the current literature is PRECEDE’s power-weighted lottery. PRECEDE orders transactions by a power-weighted randomized lottery with weight

$w(b(tx)) = b(tx)^k, \qquad k>1.$

For two competing transactions,

$$\Pr[tx_1 \prec_f^Q tx_2] = \frac{w(b(tx_1))}{w(b(tx_1)) + w(b(tx_2))} = \frac{b(tx_1)^k}{b(tx_1)^k+b(tx_2)^k}.$$

Implementation uses a random beacon and a score construction

$$r(tx)=H(tx \,\|\, Q), \qquad s(tx)=r(tx)^{1/w(b(tx))} = r(tx)^{1/b(tx)^k},$$

followed by sorting in descending score order. PRECEDE’s central claim is not that randomness directly reveals causality, but that a suitable lottery plus a losing-fee rule can make front-running irrational. With reward $R$, losing-fee rate $\gamma$, and total user weight $W$, attacker utility is

$p_t = \frac{y_t}{x_t},$0

The paper proves that entry is unprofitable for all $p_t = \frac{y_t}{x_t},$1 iff

$p_t = \frac{y_t}{x_t},$2

with corresponding deterring bid

$p_t = \frac{y_t}{x_t},$3

It further proves an anti-spam condition when

$p_t = \frac{y_t}{x_t},$4

under which a participant weakly prefers one merged bid to bid-splitting (Chen et al., 13 Jul 2026).

A second, narrower form of randomized ordering appears in Commit-Reveal$p_t = \frac{y_t}{x_t},$5, which randomizes reveal order rather than transaction execution order. It introduces two nested commit-reveal rounds: participants first submit second-layer commitments, then reveal first-layer commitments, after which the contract computes

$p_t = \frac{y_t}{x_t},$6

and derives a reveal-order metric

$p_t = \frac{y_t}{x_t},$7

Reveal-2 is enforced in descending $p_t = \frac{y_t}{x_t},$8 order via checks of the form

$p_t = \frac{y_t}{x_t},$9

The purpose is to remove the fixed last mover advantage of standard commit-reveal. The paper does not provide a full theorem-proof security treatment, but it argues that making the second reveal order dependent on earlier protocol outputs reduces last-revealer leverage. Its hybrid off-chain model posts only Merkle roots on-chain and reports gas usage from about 569,412 to 2,484,566 gas for the fully on-chain version versus about 100,732 to 175,569 gas for the hybrid version, which it characterizes as over 80% lower gas (Lee et al., 4 Apr 2025).

These two designs illustrate two distinct senses of randomization. PRECEDE randomizes transaction priority itself. Commit-Reveal$$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$0 randomizes an auxiliary reveal sequence so that subsequent randomness generation becomes harder to bias.

3. Execution semantics, validity constraints, and empirical feasibility

Randomizing order inside a blockchain block is technically nontrivial because transaction validity is state-dependent. The Ethereum permutation study examines this directly by re-executing mainnet blocks under sender-aware randomized orderings. The study observed 335,886 blocks, of which 335,646 contained transactions, with more than 56 million transactions overall, more than 72 million block permutations examined for invalidity, and more than 42 billion permuted transaction executions recorded for gas behavior (Droll, 29 Sep 2025).

The permutation method is deliberately constrained. Instead of shuffling individual transactions arbitrarily, it recovers each sender, constructs the sender list in original block order, shuffles that sender list with Fisher–Yates, and then reconstructs the block while preserving each sender’s internal transaction order. If a block has fewer than seven distinct senders, all possible sender permutations are evaluated; otherwise, 1000 permutations per block are sampled. This design directly targets nonce preservation, since nonce mismatches within a sender sequence would trivially invalidate many permutations (Droll, 29 Sep 2025).

The main empirical result is that about 22% of block permutations are invalid, affecting 35% of blocks. Among invalid permutations, 71% fail due to insufficient funds and 29% because the block gas limit is reached; 4.6% of blocks exhibit both forms of invalidity. The study further reports that 99.93% of transactions causing insufficient-funds errors under permutation are privately mined. At the same time, the gas-sensitivity results are relatively mild: only 6% of transactions show deviations in gas consumption, and 98% of block permutations deviate at most 10% from original block gas consumption. The paper’s interpretation is that randomized transaction ordering may be feasible if transaction selection is handled carefully, especially with respect to privately mined transactions and blocks close to the gas limit (Droll, 29 Sep 2025).

AMM sequencing work shows why feasibility cannot be reduced to block-validity checks alone. CLVR treats order as a factorial-size search over $$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$1 permutations and notes that even at one billion evaluations per second, brute-forcing 17 trades would take on the order of 100 hours. It therefore proposes a greedy heuristic, Clever Look-ahead Volatility Reduction, that at each step chooses the next trade minimizing

$$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$2

The algorithm has $$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$3 cost, is not globally optimal in all cases, and is explicitly a deterministic approximation rather than a randomization procedure. Its significance here is negative but important: the fact that a randomized order is technically admissible does not imply that it is economically desirable, because different permutations optimize different objectives (McLaughlin et al., 2024).

A plausible implication is that deployable randomized ordering requires two layers of design. One layer must preserve protocol validity under stateful execution. The other must specify what economic criterion the induced order is meant to approximate or defend.

4. Deterministic fair-ordering alternatives

A substantial part of the literature rejects randomization and instead derives order from deterministic fairness rules. Tilikum is the clearest DAG-based example. For ordering linearizability, each replica timestamps a transaction the first time it sees it using a pair $$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$4, collects $$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$5 signed timestamp pairs, and sets the final timestamp to the median of the physical timestamps. Its guarantee is: if the highest timestamp provided by a correct party for $$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$6 is lower than the smallest timestamp provided by a correct party for $$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$7, then all correct parties order $$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$8 before $$Vol(\sigma)= \frac{1}{n}\sum_{i=1}^{n}\left(\ln p_0 - \ln P(\sigma,i)\right)^2$$9. The protocol’s novelty is to achieve this on a DAG without weak edges by maintaining a Logical Table of committed timestamp pairs, computing an execution threshold from row heads, and using hole fillers to advance rows whose timestamp pairs were not included in committed batches. Its BOF variant builds a dependency graph and finalizes order through SCC condensation and topological ordering. Under attack, fissure, sluggish, and speculative attacks succeed on vanilla Narwhal/Tusk with success rates between 14% and 95%, but drop to 0% against Tilikum. Performance results include about 14,000 tx/s at $$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$0 with roughly 1.2 s latency for Tilikum-OL, about $$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$1 Pompē’s throughput at that scale, and roughly double Themis’ throughput for Tilikum-BOF (Segalini et al., 25 Jun 2026).

TimeBoost offers a different deterministic compromise. It proves that any policy satisfying independence of irrelevant transactions must be score-based, then orders transactions by

$$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$2

with

$$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$3

and in much of the analysis $$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$4. Ordering is descending in score. Because $$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$5 is bounded above by $$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$6, no bid can buy more than $$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$7 units of time, which yields bounded finality while moving competition away from pure latency races. The protocol is transaction-data-independent and therefore compatible with encrypted transactions, but it is not randomized ordering; tie-breaking can be specified separately, and the core mechanism remains deterministic (Mamageishvili et al., 2023).

Masquerade is also deterministic. It introduces user-purchased tokens and requires block-builders to order tokenized transactions strictly by ascending token number, with all tokenized transactions preceding non-tokenized transactions. The protocol does not randomize order within a block and does not use a lottery. Instead, it attempts to make adverse reordering economically difficult because token numbers are assigned when purchased and cannot be chosen by users. In one representative setting with $$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$8, $$Gini(\sigma)=\frac{2\cdot \sum_{i=1}^{n} i \cdot W_i}{n\cdot \sum_{i=1}^{n}W_i} - \frac{n+1}{n}.$$9, $w(b(tx)) = b(tx)^k, \qquad k>1.$0, user initial wealth 1000, and adversary initial wealth 500, the paper reports 100% frontrun under the status quo, about 29.81% frontrun under Masquerade, and 0% in an ideal no-attack case (Vedula et al., 2023).

These protocols are often discussed alongside randomized ordering because they address the same adversarial surface. Their common conclusion is that fairness can be pursued through deterministic timestamps, token priorities, or score functions rather than through explicit random permutation.

5. Removing the ordering problem instead of randomizing it

Another major design line argues that the right response is not to randomize order, but to minimize or eliminate the need for total order. Accept is explicit on this point. It uses the UTXO model, requires each validator to verify signatures, input confirmations, and prior local validation of spends, and finalizes a transaction when the client has collected signatures from a quorum of size $w(b(tx)) = b(tx)^k, \qquad k>1.$1. A set of $w(b(tx)) = b(tx)^k, \qquad k>1.$2 signatures of distinct validators constitutes a confirmation of the outputs. The system does not place transactions into blocks or append them to a chain position; unrelated transactions are intentionally left unordered, and only conflicting transactions are prevented from both being confirmed. The paper states that Accept does not depend on a source of randomness and does not rely on randomness. Its scalability claim is tied directly to this relaxed ordering semantics, with reported throughput for four validators of 48,667 TPS with one shard, 92,115 TPS with two shards, 183,380 TPS with four shards, and about 1,449,847 TPS on average with 37 shards per validator (Mathys et al., 2021).

Groundhog removes ordering inside a block even more aggressively. Transactions in the same block are not ordered relative to one another. Instead, all transactions read the same pre-block snapshot, emit typed modifications, and rely on deterministic merging rules over storage objects such as bytestrings, nonnegative integers, ordered sets, and deletions. Irreconcilable conflicts are controlled by a reserve-commit process and object-level validity constraints rather than by sequential serialization. The paper states that semantically, there is no ordering relation between transactions in the same block, and that transaction throughput never suffers from contention between transactions. On 96 CPU cores, Groundhog reports more than half a million payment transactions per second, whether between 10M accounts or just 2 (Ramseyer et al., 2024).

PDCC occupies a related but distinct position in certificate-based payment systems. It explicitly avoids randomized transaction ordering and global transaction ordering, using per-account sequence numbers or nonces, certificate-based authentication $w(b(tx)) = b(tx)^k, \qquad k>1.$3, Byzantine Consistent Broadcast on the fast path, and periodic system-wide settlement or checkpoint consensus only for synchronization and reconfiguration. Reconfiguration requests are certified like transactions and installed at checkpoint boundaries, while learners do not participate in quorums until installation completes. The paper’s contribution is high performance through avoidance of global transaction ordering, not probabilistic sequencing (Shangguan, 14 Jan 2026).

These systems show that randomized ordering competes with a stronger alternative: redesigning execution semantics so that many transactions do not need to be globally ordered at all.

6. Adjacent uses of transaction randomization and semantic boundaries

The phrase “transaction randomization” is used in several neighboring literatures with meanings that are not equivalent to randomized execution order. Strokkur, for example, uses randomized transaction coding for broadcast rather than randomized ordering for execution. Nodes do not forward raw transactions; they send XOR codewords over random subsets of transactions selected from a coding window, using LT-code ideas and a peeling decoder. Randomization reduces the need for coordination about which peer lacks which transaction, but it does not choose execution order. The implementation reports 647k transactions per second on one CPU core, with evaluation showing 2–7.6x less bandwidth than Bitcoin’s existing scheme and 9x lower latency than Shrec when only 4% of nodes are adversarial (Yang et al., 2022).

Bitcoin work on OP_RAND emulation likewise concerns random branch selection rather than mempool or block sequencing. The protocol commits to multiple hidden values $w(b(tx)) = b(tx)^k, \qquad k>1.$4, derives higher-rank commitments, lets a counterparty choose one commitment without learning whether it is the designated target, and later reveals the hidden point. The winning condition is

$w(b(tx)) = b(tx)^k, \qquad k>1.$5

The result is a probabilistic, trustless choice among precommitted transaction outcomes or state transitions, not randomized transaction ordering in the ledger sense (Kurbatov, 27 Jan 2025).

Outside blockchain altogether, privacy-preserving itemset mining uses “transaction randomization” to mean database obfuscation. The cited method combines fake transaction randomization with per-transaction randomization, applying

$w(b(tx)) = b(tx)^k, \qquad k>1.$6

and reconstructing with

$w(b(tx)) = b(tx)^k, \qquad k>1.$7

Here the objective is privacy preservation while retaining the anti-monotonic property for frequent itemset mining, and the claimed reconstruction error is zero. This is terminologically adjacent but conceptually unrelated to sequencing in distributed ledgers (Boora et al., 2010).

The resulting landscape is heterogeneous. In one branch, randomized ordering is a sequencing primitive for MEV resistance or causal deterrence. In another, randomness is used to randomize reveal order, broadcast efficiently, or choose among contract branches. In a third, the design response is to avoid order or to compute it deterministically. This suggests that “randomized transaction ordering” is best understood not as a single protocol pattern, but as one point in a broader design space linking stateful execution, fairness, adversarial incentives, and the degree to which order itself is made a protocol object.