Reveal, Correct, Then Pay
Encrypted Mempools and Perpetual Funding Security
July 15, 2026
Abstract
Encrypted mempools are designed to hide transaction contents until execution order is fixed, preventing many victim dependent forms of maximal extractable value. This paper studies a different class of attack in the form of self-authored state manipulation, in which the attacker knows its own transaction and owns a downstream claim on the state that transaction changes. Perpetual futures funding is a canonical example. The funding signal determines a transfer rate, while receiving side open interest is the transfer base. In a commit then reveal mempool, an adaptive corrective transaction cannot enter the already committed batch. Privacy can therefore create an economic reaction gap even when cryptographic decryption overhead is negligible. We microfound correction through executable arbitrage opportunities. Correctors choose order size against local price impact and inventory cost, while the protocol information schedule determines which opportunities are actionable. The ordering barrier removes ordinary adaptive searchers from the closed stage. It therefore yields a closed stage correction rate \(\rho_c\) below the adaptive correction rate \(\rho_p\) whenever positive adaptive capacity becomes available after reveal. The distortion entering a funding window is multiplied by an explicit response factor \(g(\delta;\rho_c,\rho_p,W)\), where \(\delta\) is the first adaptive reaction gap. We show that \(g\) is strictly increasing in \(\delta\) under the derived rate ordering. For an attacker with endowed receiving notional, the exact expected value of manipulation is quadratic in \(m g\), where \(m\) is the fraction of targeting ability retained under privacy. Encryption is harmful precisely when the loss of attacker information is smaller than the increase in distortion persistence. We then add hidden tax base entry. Transaction privacy can also reduce capitalization of predictable funding into entry prices, producing a second amplification channel. The resulting local security index separates attacker blindness, correction shielding, and capitalization shielding.
1 Introduction↩︎
Encrypted mempools address a real defect of transparent blockchains where a pending transaction can reveal a user’s intent before execution, allowing a validator, builder, or searcher to front-run, back-run, sandwich, censor, or otherwise condition on the transaction [1]–[8]. Threshold encryption systems therefore aim to keep transaction contents secret until inclusion and ordering are fixed [9], [10]. Recent work has improved the cryptographic and systems costs of this approach through batched decryption, silent setup, randomized permutation, and direct integration with high performance BFT protocols [11]–[13].
The standard security story is compelling for victim dependent attacks. A sandwich attack requires the attacker to see another user’s trade. Hide that trade, and the attacker’s informational advantage can disappear. But not all economically relevant attacks have a victim transaction. In a self-authored attack, the adversary knows the transaction that changes application state because it authored that transaction. The adversary may also hold a claim whose payoff is increasing in the resulting state. Hiding the transaction then has two opposing effects: it can make the attack less precise, but it can also hide the attack from the agents who would correct it. Perpetual futures funding provides a clean case study. Perpetuals have no expiry, so periodic funding payments are used to keep the perpetual price near spot [14]–[16]. Economically, the funding signal sets a transfer rate and receiving side open interest sets the transfer base. An attacker can hold or acquire receiving notional, distort a mark, index, impact price, or other funding input, and collect the induced transfer. The attack is not necessarily a reordering attack. It can be a state manipulation attack whose profitability depends on how quickly arbitrageurs observe and correct the distortion. The key distinction is between cryptographic latency and economic reaction latency. Suppose an encrypted batch is ordered, then decrypted, then executed. Even if decryption adds only a few milliseconds, an arbitrageur who learns the plaintext after the order is committed cannot submit a transaction contingent on that plaintext into the same closed batch. The relevant delay is the time until the first adaptive corrective action can execute. We call this the reaction gap. It can be one block or one application round even when decryption itself is fast. This is a cross-layer composition issue, not a failure of the encryption primitive.
This paper makes four contributions.
The ordering barrier. We isolate a causal property of commit then reveal designs where without post-commit admission or precommitted contingent programs, a transaction computed from a revealed plaintext cannot execute in the committed batch. This produces a discrete economic reaction gap independently of decryption computation time.
Reaction gap manipulation. We derive \(\rho_c\) and \(\rho_p\) from a correction sector with executable opportunity arrival, local price impact, and inventory cost. The ordering barrier implies \(\rho_p>\rho_c\) whenever ordinary adaptive correction has positive capacity. We then derive the exact amount of a one shot distortion that enters a funding window. For endowed receiving notional, this gives a closed form expected attack value and an exact threshold for whether privacy helps or hurts.
A two ledger privacy multiplier. Funding security depends on both the signal and the tax base. We model entry price capitalization of predictable funding and show how hiding the attack can reduce that capitalization. A local security index decomposes the effect of encryption into attacker blindness, correction shielding, and capitalization shielding.
A decryption aware funding rule. We propose the sequence reveal, correct, measure, then pay. The rule combines a post-reveal correction buffer with tax base eligibility or time aligned notional accrual. Under a one-shot hidden impulse, we derive an explicit buffer sufficient to bound incremental dollar extraction.
Encrypted mempools protect users against important classes of victim dependent MEV. They do not universally reduce every notion of economic manipulation. Our result applies when (i) a hidden transaction can move an input to a downstream transfer, (ii) the attacker retains enough information to author that transaction, and (iii) privacy slows or suppresses corrective response or capitalization. It does not apply in the same form when the application uses a genuinely exogenous, non-manipulable signal or supplies an application native reaction phase.
2 Related work↩︎
2.0.0.1 Encrypted mempools.
Ferveo defines mempool privacy by keeping transactions encrypted until inclusion is finalized and by coupling inclusion to decryption and execution [9]. Choudhuri, Garg, Piet, and Policharla formalize batched threshold public key encryption and show how pending transaction privacy can be obtained with communication independent of batch size [17]. BEAST-MEV combines batched decryption with silent setup [12], while TrX integrates encrypted mempools with a high performance BFT pipeline and reports low proposal to execution overhead [13]. BlindPerm observes that encryption alone does not eliminate all producer side ordering power and adds randomized permutation after commitment [11]. These papers primarily study confidentiality, ordering, setup, availability, and systems cost. We assume those cryptographic goals are met and study the downstream application’s transfer rule. Related constructions include FairBlock’s minimal overhead front-running prevention [18], F3B’s per-transaction protection [19], one time setup batched threshold encryption [17], and epochless batched threshold encryption [20]. These rely on threshold encryption and encryption to the future primitives [21]–[24]. A complementary line of work enforces ordering fairness at the consensus layer rather than through encryption [25]–[29].
2.0.0.2 Economic effects of privacy.
Rondelet and Kilbourn argue that private mempools must be evaluated through an economic lens, including congestion, information asymmetry, price discovery, and liquidation efficiency [30]. In particular, they note that a transparent mempool can allow a liquidation triggered by a price moving transaction to occur in the same block, whereas hidden transaction contents may defer the liquidator’s response to a later block. Our reaction gap model formalizes the analogous mechanism for self-authored state manipulation and derives dollar security conditions. V0LVER is an example of an application aware design as it combines encrypted orders with an explicit price update and batch clearing mechanism rather than treating encryption as a complete market design [31].
2.0.0.3 Perpetual funding and market design.
The perpetual futures literature studies no-arbitrage pricing, funding cash flows, and the role of funding in anchoring the perpetual to spot [14]–[16]. We use only the local transfer structure, a measured premium changes the payment rate, and receiving notional scales the dollar transfer. Frequent batch auctions show more broadly that a discrete reaction and clearing stage can replace competition on raw speed with competition on price [32]. Our proposal is narrower and we claim only that after decryption, an oracle linked application should expose a correction or clearing stage before irreversible measurement and payment. The economics of AMM pricing [33] and of batching trades against an AMM [34] are also relevant to how corrective arbitrage prices distortion.
2.0.0.4 Difference from prior work.
The cryptographic literature asks whether pending transactions remain confidential until ordering is fixed and whether the resulting protocol is efficient and available. Our paper asks a separate composition question, after a correctly private batch changes application state, does the application immediately pay against that state, or does it first allow the market to correct and capitalize the new information? Automated economic security analysis of smart contracts exists [35], but we are not aware of prior work deriving this reaction gap and tax base interaction for perpetual funding.
3 Protocol and funding model↩︎
3.1 Commit, reveal, execute, react↩︎
Consider a batch \(B\). At time \(t_c\), the protocol closes admission and fixes the batch’s transaction set and execution order. At time \(t_r\ge t_c\), the relevant plaintexts become available. Transactions are then executed, possibly immediately. We focus on the common design in which no new transaction can be admitted to \(B\) after \(t_c\).
Definition 1 (Adaptive corrective transaction). Given a revealed transaction \(x\), an adaptive corrective transaction is a transaction \(c(x)\) whose payload or execution parameters depend nontrivially on the plaintext or execution effect of \(x\). Examples include a backrun that restores an AMM price to an external reference, a liquidation triggered by a revealed state change, or an order that offsets a revealed funding signal distortion.
Lemma 1 (Ordering barrier). Suppose the admissible transaction set and order of batch \(B\) are fixed before the plaintext of \(x\) is revealed, and the protocol provides neither post-commit admission nor a precommitted contingent program that implements \(c(x)\). Then an adaptive corrective transaction computed after reveal cannot execute in \(B\). Its earliest execution is in a later batch or application reaction stage.
Proof. At the time \(c(x)\) can first be computed, admission to \(B\) has closed and the contents of \(B\) are fixed. Therefore \(c(x)\notin B\). The conclusion is independent of how quickly the plaintext is decrypted. ◻
The purpose of the previous lemma is to separate a scheduling fact from a cryptographic benchmark. Faster threshold decryption can reduce \(t_r-t_c\) and materially improve latency [13], [36]. It does not by itself reopen a committed batch. Protocol native arbitrage, conditional intents, or a reveal then clear phase can remove the barrier. We return to these designs in Section 6. Let \(\delta\geq0\) denote the time from the attack’s state effect to the first execution opportunity for an adaptive correction. In a stylized transparent mempool benchmark, searchers can observe a pending transaction before order closure and submit a contingent backrun, so \(\delta=0\). This is a benchmark, not a guarantee, since a public mempool may also have a positive effective reaction gap. All comparisons below remain valid with an arbitrary public value \(\delta_{\mathrm{pub}}\). The substantive condition is that the encrypted design raises the effective reaction gap or lowers correction intensity.
3.2 Funding as a two ledger transfer↩︎
Let \(y\geq0\) be the initial size of the self-authored signal distortion. Let \(Z_t\) be the realized adversarial component of a funding signal relative to a no-attack path, with \(Z_0=y\), and write \(z_t:=\mathbb{E}[Z_t\mid Z_0=y]\). A funding event measures the average distortion over a window of length \(W>0\). Only correction before the end of this window matters. We therefore replace a larger raw reaction gap by \(\min\{\delta,W\}\) and retain the notation \(\delta\), so \(0\leq\delta\leq W\). The expected adversarial component is \[\bar z_W :=\mathbb{E}\left[ \left. \frac{1}{W}\int_0^W Z_t\,dt \right|Z_0=y \right] =\frac{1}{W}\int_0^W z_t\,dt, \label{eq:average-signal}\tag{1}\] and converts it into an expected per unit funding transfer \(\tau\bar z_W\), where \(\tau>0\) is local signal to payment pass through. We use a risk neutral attacker and work on one favorable sign branch inside any rate cap. Caps and global position limits bound the scale of the attack but do not change the local comparative statics.
The attacker may have two types of receiving notional.
\(N_0\ge0\) is endowed notional: a position held before the hidden transaction is submitted. It pays no event specific entry premium.
\(N\ge0\) is created notional: a position opened close enough to the event to exploit the predictable transfer. It may pay an adverse entry price and other acquisition costs.
This is the two ledger structure. The signal ledger determines the rate, while the notional ledger determines the dollar base. A mechanism that protects only one ledger can remain vulnerable through the other. Let \(a y^2\), where \(a>0\), be the local all in cost of creating the initial distortion. Let \(m\in[0,1]\) be the fraction of targeting ability retained by the attacker under the relevant information regime. The parameter \(m\) absorbs uncertainty about hidden honest flow, ordering, transaction success, and the sign of interactions with other concealed transactions. Victim dependent attacks can have small \(m\) under encryption. A self-authored attack can retain \(m\) close to one because the attacker still knows its own order and any external reference price.
4 The reaction gap channel↩︎
4.1 Correction from executable arbitrage↩︎
We first derive the two correction rates from corrector behavior and the protocol information schedule. Work on the favorable sign branch \(Z\geq 0\). A corrector that can execute an order of size \(x\geq 0\) reduces the distortion from \(Z\) to \(Z-\ell x\), where \(\ell>0\) is local state impact. The gross value of traversing the resulting linear discrepancy is \[\int_0^x (Z-\ell u)\,du =Zx-\frac{\ell}{2}x^2. \label{eq:corrector-gross-value}\tag{2}\] A corrector of type \(i\) has an additional quadratic cost \(k_i x^2/2\), where \(k_i\geq0\) captures fees, inventory risk, and limited balance sheet capacity. Conditional on an actionable correction opportunity, it therefore solves \[\max_{0\leq x\leq Z/\ell} \left\{Zx-\frac{\ell+k_i}{2}x^2\right\}. \label{eq:corrector-problem}\tag{3}\] The unique solution and the fraction of distortion removed are \[x_i^\ast(Z)=\frac{Z}{\ell+k_i}, \qquad \theta_i:=\frac{\ell x_i^\ast(Z)}{Z} =\frac{\ell}{\ell+k_i}\in(0,1]. \label{eq:corrector-response}\tag{4}\]
Let \(\mathcal{I}\) be a finite set of corrector types. Potential opportunities for type \(i\) arrive according to an independent Poisson process with intensity \(\nu_i\geq0\). In stage \(s\in\{c,p\}\), an opportunity is actionable with probability \(\alpha_{i,s}\in[0,1]\). Actionability requires both an executable protocol opportunity and enough information to select the correct signed order. A corrector abstains when either condition fails. Thus the usable opportunities are a thinned Poisson process with intensity \(\nu_i\alpha_{i,s}\).
Proposition 1 (Correction rate from market primitives). Suppose the primitives above are constant within stage \(s\). Starting from distortion \(Z_0=y\), the expected residual distortion after time \(t\) is \[\mathbb{E}[Z_t\mid Z_0=y]=y e^{-\rho_s t}, \qquad \rho_s=\sum_{i\in\mathcal{I}} \nu_i\alpha_{i,s}\frac{\ell}{\ell+k_i}. \label{eq:microfounded-rate}\qquad{(1)}\] In particular, \(\rho_p\geq\rho_c\) whenever \(\alpha_{i,p}\geq\alpha_{i,c}\) for every type. The inequality is strict whenever this comparison is strict for a type with \(\nu_i>0\).
Proof. An actionable type \(i\) opportunity multiplies the residual distortion by \(1-\theta_i\). Let \(N_{i,s}(t)\) be the number of such opportunities by time \(t\). Poisson thinning gives \(N_{i,s}(t)\sim\operatorname{Pois}(\nu_i\alpha_{i,s}t)\). Independence and the probability generating function of a Poisson random variable give \[\begin{align} \mathbb{E}[Z_t\mid Z_0=y] &=y\prod_{i\in\mathcal{I}} \mathbb{E}\left[(1-\theta_i)^{N_{i,s}(t)}\right] \\ &=y\prod_{i\in\mathcal{I}} \exp\left(-\nu_i\alpha_{i,s}\theta_i t\right) =y e^{-\rho_s t}. \end{align}\] The rate comparison follows term by term from ?? . ◻
The ordering barrier gives the actionability comparison a direct protocol interpretation.
Corollary 1 (Ordering induced rate gap). Partition the correction sector into precommitted types \(\mathcal{C}\) and ordinary adaptive types \(\mathcal{A}\). A precommitted type has closed stage coverage \(q_i\in[0,1]\). An ordinary adaptive type has zero closed stage actionability. Normalize actionability to one once public adaptive execution resumes. Then \[\begin{align} \rho_c &=\sum_{i\in\mathcal{C}}\nu_iq_i\theta_i, \label{eq:rho-c-derived}\\ \rho_p &=\sum_{i\in\mathcal{C}}\nu_i\theta_i +\sum_{i\in\mathcal{A}}\nu_i\theta_i, \label{eq:rho-p-derived}\\ \rho_p-\rho_c &=\sum_{i\in\mathcal{C}}\nu_i(1-q_i)\theta_i +\sum_{i\in\mathcal{A}}\nu_i\theta_i. \label{eq:rho-gap-derived} \end{align}\] {#eq: sublabel=eq:eq:rho-c-derived,eq:eq:rho-p-derived,eq:eq:rho-gap-derived} Hence \(\rho_p>\rho_c\) if some precommitted coverage is incomplete or if ordinary adaptive correction has positive capacity.
Proof. By Lemma 1, an ordinary adaptive type has \(\alpha_{i,c}=0\). The other actionability parameters are \(\alpha_{i,c}=q_i\) for \(i\in\mathcal{C}\) and \(\alpha_{i,p}=1\) for every type. Substitute these values into ?? . ◻
The parameter \(q_i\) is the probability that a fixed program both covers the hidden impulse and can execute after it. Normalizing later actionability to one is without loss for the benchmark because a common later execution probability can be absorbed into \(\nu_i\). More generally, Proposition 1 only requires later actionability to dominate closed stage actionability.
In the homogeneous case, let \(\nu_C\) and \(\nu_A\) be the total opportunity intensities of the two sectors, let closed stage coverage be \(q\), and let every opportunity remove fraction \(\theta\). Then \[\rho_c=q\nu_C\theta, \qquad \rho_p=(\nu_C+\nu_A)\theta, \qquad \frac{\rho_c}{\rho_p} =q\frac{\nu_C}{\nu_C+\nu_A}. \label{eq:rho-ratio-homogeneous}\tag{5}\] Equation 5 separates coverage from adaptive capacity. With no protocol native or precommitted correction, \(\nu_C=0\) and therefore \(\rho_c=0\). Equality \(\rho_c=\rho_p\) requires full closed stage coverage and no correction capacity that becomes newly actionable after reveal. A protocol native correction module works by moving capacity from \(\mathcal{A}\) into \(\mathcal{C}\) and raising its coverage.
The exponential law in Proposition 1 is exact for expected distortion. It is also the deterministic fluid limit when individual correction fractions shrink and opportunity intensities grow while \(\nu_i\theta_i\) remains fixed.
Remark 1 (Fixed correction costs). The constant rate law is an interior local model. If type \(i\) also pays fixed execution cost \(f_i>0\), its optimized variable surplus is \(Z^2/[2(\ell+k_i)]\). It therefore acts only when \[|Z|\geq\sqrt{2f_i(\ell+k_i)}. \label{eq:corrector-entry-threshold}\qquad{(2)}\] The local correction rate becomes \[\rho_s(Z) =\sum_{i\in\mathcal{I}} \nu_i\alpha_{i,s}\frac{\ell}{\ell+k_i} \mathbf{1}\left\{|Z|\geq\sqrt{2f_i(\ell+k_i)}\right\}. \label{eq:state-dependent-rho}\qquad{(3)}\] Correction can slow as the distortion approaches zero. Nested actionability still gives \(\rho_p(Z)\geq\rho_c(Z)\) pointwise, but the closed form response factor below need not survive. The constant rate model applies on a region where the active set, depth, and inventory limits are fixed.
4.2 The induced two stage response↩︎
After the attack changes state, there is an interval \([0,\delta)\) in which a correction newly computed from the revealed transaction cannot yet execute. Proposition 1 gives rate \(\rho_c\) during this closed stage and rate \(\rho_p\) once adaptive correction can execute. For a one shot impulse \(y\), the expected response is \[z_t= \begin{cases} y e^{-\rho_c t}, & 0\le t<\delta,\\[3pt] y e^{-\rho_c\delta}e^{-\rho_p(t-\delta)}, & \delta\le t\le W. \end{cases} \label{eq:two32speed-dynamics}\tag{6}\] For \(\rho\ge0\) and \(s\ge0\), write \[A(\rho,s):= \begin{cases} (1-e^{-\rho s})/\rho, & \rho>0,\\ s, & \rho=0. \end{cases} \label{eq:A-def}\tag{7}\] Since the funding transfer is linear in the measured signal, expected attack value depends on the expected average distortion. This is \(\bar z_W=g(\delta;\rho_c,\rho_p,W)y\), where \[g(\delta;\rho_c,\rho_p,W) =\frac{A(\rho_c,\delta)+e^{-\rho_c\delta}A(\rho_p,W-\delta)}{W}. \label{eq:g-general}\tag{8}\]
Proposition 2 (Reaction gap monotonicity). Suppose \(0\le\delta<W\) and \(\rho_p>0\). Under the correction sector above, \[\frac{\partial g}{\partial\delta} = \frac{e^{-\rho_c\delta}}{W} \left(1-\frac{\rho_c}{\rho_p}\right) \left(1-e^{-\rho_p(W-\delta)}\right) = \frac{e^{-\rho_c\delta}}{W} \frac{\rho_p-\rho_c}{\rho_p} \left(1-e^{-\rho_p(W-\delta)}\right). \label{eq:g-derivative}\qquad{(4)}\] Hence \(g\) is weakly increasing in the reaction gap. It is strictly increasing exactly when some correction capacity becomes more actionable after reveal, so that \(\rho_p>\rho_c\). It is constant when the closed stage already exposes the full correction sector and \(\rho_p=\rho_c\).
Proof. Differentiate 8 . Since \(\partial_\delta A(\rho_c,\delta)=e^{-\rho_c\delta}\) and \(\partial_\delta A(\rho_p,W-\delta)=-e^{-\rho_p(W-\delta)}\), collecting terms gives ?? . Equations ?? and ?? give \(\rho_p\geq\rho_c\), with strict inequality under the condition in the statement. ◻
In a technology matched comparison, the public regime exposes the full correction sector from time zero, while the encrypted regime delays some of that sector until \(\delta\). Hence \[g_{\mathrm{pub}}=\frac{A(\rho_p,W)}{W}, \qquad g_{\mathrm{enc}} =\frac{A(\rho_c,\delta) +e^{-\rho_c\delta}A(\rho_p,W-\delta)}{W}. \label{eq:matched-response}\tag{9}\] Proposition 2 gives \[\frac{g_{\mathrm{enc}}}{g_{\mathrm{pub}}} =\frac{A(\rho_c,\delta) +e^{-\rho_c\delta}A(\rho_p,W-\delta)}{A(\rho_p,W)} \geq1, \label{eq:matched-amplification}\tag{10}\] with strict inequality when \(\delta>0\) and \(\rho_p>\rho_c\).
Remark 2 (Correction technologies that are not nested). The first equality in ?? remains valid when later correction technologies do not contain the closed stage technologies. In that extension, \(\rho_p<\rho_c\) is possible only because some correction technology available during the closed stage is disabled later. It is not produced by the commit then reveal barrier itself.
The benchmark with no effective closed stage correction has \(\mathcal{C}=\varnothing\), so \(\rho_c=0\). Write \(\rho:=\rho_p\). Then The transparent same batch reaction benchmark is \[g(0;0,\rho,W)=\frac{1-e^{-\rho W}}{\rho W}. \label{eq:g-public}\tag{12}\] Thus the reaction gap amplification factor is \[R_g(\delta) :=\frac{g(\delta;0,\rho,W)}{g(0;0,\rho,W)} =\frac{\rho\delta+1-e^{-\rho(W-\delta)}}{1-e^{-\rho W}}. \label{eq:reaction-amplification}\tag{13}\] If \(\rho W\to\infty\) and \(\rho(W-\delta)\to\infty\), then \[R_g(\delta)=1+\rho\delta+o(1). \label{eq:reaction-asymptotic}\tag{14}\] This comparative static is easy to miss, a fixed one block reaction gap can matter most in markets where transparent corrective arbitrage would otherwise be fastest.
4.3 Endowed notional and the information threshold↩︎
An attacker with endowed receiving notional \(N_0\) has expected incremental payoff \[\Pi_0(y)=mN_0\tau g\,y-a y^2, \label{eq:endowed-payoff}\tag{15}\] where \(g=g(\delta;\rho_c,\rho_p,W)\).
Proposition 3 (Endowed notional value). The optimal one shot distortion and its expected dollar value are \[y^\ast=\frac{mN_0\tau g}{2a}, \qquad V_0=\frac{m^2N_0^2\tau^2g^2}{4a}. \label{eq:endowed-solution}\qquad{(5)}\]
Proof. Maximize the concave quadratic 15 in \(y\). ◻
Let \(j\in\{\mathrm{pub},\mathrm{enc}\}\) index public and encrypted regimes. Allow the local distortion cost and pass through to differ across regimes. Assume the public benchmark has \(V_{0,\mathrm{pub}}>0\), so the ratios below are defined. Proposition 3 gives \[\frac{V_{0,\mathrm{enc}}}{V_{0,\mathrm{pub}}} = \frac{a_{\mathrm{pub}}}{a_{\mathrm{enc}}} \left( \frac{m_{\mathrm{enc}}\tau_{\mathrm{enc}}g_{\mathrm{enc}}}{m_{\mathrm{pub}}\tau_{\mathrm{pub}}g_{\mathrm{pub}}} \right)^2. \label{eq:endowed-ratio-general}\tag{16}\] With unchanged execution cost and application pass through, \[V_{0,\mathrm{enc}}>V_{0,\mathrm{pub}} \quad\Longleftrightarrow\quad \frac{m_{\mathrm{enc}}}{m_{\mathrm{pub}}} > \frac{g_{\mathrm{pub}}}{g_{\mathrm{enc}}}. \label{eq:information-threshold}\tag{17}\] There is therefore no unconditional “privacy improves manipulation security” theorem. Privacy helps when the attacker’s lost targeting ability dominates the persistence gained from weaker correction. For a self-authored attack, \(m_{\mathrm{enc}}/m_{\mathrm{pub}}\) may be close to one, in which case any increase in \(g\) raises attack value. For a victim-dependent attack, the information ratio can be near zero, in which case privacy is strongly protective.
As a synthetic illustration, take \(\rho W=8\), no closed stage correction, and \(\delta/W=0.1\). Then \(R_g\approx1.80\), so attack value rises by a factor of about \(3.24\) when targeting is unchanged. Encryption still raises value whenever the attacker retains more than \(1/1.80\approx56\%\) of its public mempool targeting ability. The numbers are not a venue calibration, they show that a discrete reaction opportunity can dominate modest information loss.
5 The tax base channel↩︎
Reaction speed prices only the signal ledger. Funding has a second ledger, who owns the receiving notional when the payment is made. A timestamp based eligibility rule can allow an attacker to enter in the concealed batch after the transfer is largely predictable. Public observability can make that entry expensive because competing traders bid the predictable funding into the entry price. Encryption can suppress that capitalization.
5.1 Visibility and capitalization↩︎
Let \[p=q_0y, \qquad q_0:=m\tau g, \label{eq:predictable-payment}\tag{18}\] be the predictable expected incremental funding payment per unit of receiving notional generated by distortion \(y\). Let \(e\) be the adverse entry premium paid by a trader entering the receiving side before the funding event. Introduce an effective visibility parameter \(v\in[0,1]\). The value \(v=1\) means that competing traders can condition their entry on the pending manipulation, \(v=0\) means that no transaction specific entry can be submitted before the relevant batch closes.
Competing sniping demand and passive entry supply are \[D(e;p)=v\kappa_M(p-e)_+, \qquad S(e)=\kappa_L e, \label{eq:entry-market}\tag{19}\] where \(\kappa_M\ge0\) measures responsive capital and \(\kappa_L>0\) is entry depth.
Proposition 4 (Visibility dependent capitalization). For \(p>0\), the entry market clears at \[e^\ast=\zeta(v)p, \qquad \zeta(v)=\frac{v\kappa_M}{v\kappa_M+\kappa_L}. \label{eq:zeta}\qquad{(6)}\] The capitalization coefficient is increasing in visibility and responsive competing capital, and decreasing in entry depth. A newly entered receiver retains only \((1-\zeta)p\) before residual costs.
Proof. On the positive branch, market clearing gives \(v\kappa_M(p-e)=\kappa_Le\). Solving for \(e\) yields ?? . ◻
The parameter \(v\) is not synonymous with raw cryptographic leakage. It is the fraction of the transaction specific opportunity that can be converted into a competing order before the eligibility cutoff. A decrypt then clear mechanism can have high effective \(v\) even if the pre-commit mempool is perfectly private. A serial order then reveal execute mechanism can have \(v\approx0\) for same batch entry even when decryption itself is immediate.
5.2 The two ledger security index↩︎
Let \(N\) be notional created for the event. Its local acquisition, carry, adverse self-impact, and unwind cost is summarized by \(bN^2\), \(b>0\). Endowed notional \(N_0\) receives the full predictable payment, while created notional receives the residual after capitalization. Define \[q:=(1-\zeta)q_0=(1-\zeta)m\tau g. \label{eq:q-created}\tag{20}\] The expected local payoff is \[\Pi(N,y)=q_0N_0y+qNy-a y^2-bN^2. \label{eq:two-ledger-payoff}\tag{21}\]
Theorem 1 (Two ledger amplification). Define the local tax base security index \[\Gamma:=\frac{q^2}{4ab} = \frac{(1-\zeta)^2m^2\tau^2g^2}{4ab}. \label{eq:Gamma}\qquad{(7)}\] If \(\Gamma<1\), the unique optimum is \[y^\ast=\frac{2bq_0N_0}{4ab-q^2}, \qquad N^\ast=\frac{qq_0N_0}{4ab-q^2}, \label{eq:two-ledger-controls}\qquad{(8)}\] with value \[V=\frac{q_0^2N_0^2}{4a(1-\Gamma)}. \label{eq:two-ledger-value}\qquad{(9)}\] If \(\Gamma>1\), the quadratic model has a positive homogeneous attack direction and is locally scalable until a cap, budget, position limit, or global impact curve binds. At \(\Gamma=1\), the homogeneous quadratic vanishes along a nonzero ray. If \(q_0N_0>0\), endowed notional creates unbounded linear gain along that ray. If \(q_0N_0=0\), payoff is zero along the ray rather than unbounded.
Proof. The Hessian of 21 in \((y,N)\) is negative definite exactly when \(4ab-q^2>0\). Under that condition, the first order conditions are \(2ay-qN=q_0N_0\) and \(2bN=qy\). Solving gives ?? , and substitution gives ?? . If \(q^2>4ab\), the homogeneous quadratic form has a positive eigenvalue. At the boundary, evaluate the linear endowed notional term along the zero curvature ray. It is positive exactly when \(q_0N_0>0\). ◻
The factor \((1-\Gamma)^{-1}\) is a tax base amplification multiplier. Endowed notional creates a finite seed value even when created notional alone is not locally profitable. Cheap hidden entry then scales up both the optimal distortion and the receiving base. As \(\Gamma\) approaches one, small changes in reaction speed or capitalization have large effects.
For two regimes with the same \(a,b,\) and \(\tau\), assume \(m_{\mathrm{pub}}>0\) and \(\zeta_{\mathrm{pub}},\zeta_{\mathrm{enc}}<1\). The security index ratio is then \[\frac{\Gamma_{\mathrm{enc}}}{\Gamma_{\mathrm{pub}}} = \underbrace{\left(\frac{m_{\mathrm{enc}}}{m_{\mathrm{pub}}}\right)^2}_{\text{attacker blindness}} \underbrace{\left(\frac{g_{\mathrm{enc}}}{g_{\mathrm{pub}}}\right)^2}_{\text{correction shielding}} \underbrace{\left( \frac{1-\zeta_{\mathrm{enc}}}{1-\zeta_{\mathrm{pub}}} \right)^2}_{\text{capitalization shielding}}. \label{eq:Gamma-decomposition}\tag{22}\] When both regimes satisfy \(\Gamma<1\) and \(V_{\mathrm{pub}}>0\), their finite expected values satisfy \[\frac{V_{\mathrm{enc}}}{V_{\mathrm{pub}}} = \left( \frac{m_{\mathrm{enc}}g_{\mathrm{enc}}}{m_{\mathrm{pub}}g_{\mathrm{pub}}} \right)^2 \frac{1-\Gamma_{\mathrm{pub}}}{1-\Gamma_{\mathrm{enc}}}. \label{eq:value-decomposition}\tag{23}\] Equation 22 is the central composition result. Encryption can reduce the first term while increasing the second and third. For local tax base scalability, encryption is harmful exactly when \[\frac{m_{\mathrm{enc}}}{m_{\mathrm{pub}}} > \frac{g_{\mathrm{pub}}}{g_{\mathrm{enc}}} \frac{1-\zeta_{\mathrm{pub}}}{1-\zeta_{\mathrm{enc}}}, \label{eq:Gamma-threshold}\tag{24}\] under unchanged costs and pass through.
The capitalization channel can make this threshold much lower than the endowed notional threshold 17 . For example, if public visibility capitalizes \(80\%\) of predictable funding, encrypted same batch entry capitalizes none, and the reaction gap factor is \(1.8\), then \(\Gamma_{\mathrm{enc}}>\Gamma_{\mathrm{pub}}\) whenever the attacker retains more than roughly \(11\%\) of its public information effectiveness. Again, this is a model illustration rather than a venue estimate. It shows why a mechanism that hides both the signal trade and the recipient’s entry can differ sharply from one that merely hides a victim’s order.
6 Reveal, correct, measure, then pay↩︎
The result is not an argument against encrypted mempools. It is an argument against composing a commit then reveal ordering layer with an application that immediately treats the first post-reveal state as a payment oracle. The application should insert an economically meaningful stage between reveal and payment.
6.1 A decryption aware rule↩︎
Consider the following sequence.
Order and reveal. Commit the encrypted batch, reveal its transactions, and execute or simulate the resulting state transition.
Correct. Permit a public reaction period of length \(L\), a reaction auction, or a protocol native rebalancing step. The reaction mechanism must be able to condition on the revealed state.
Measure. Begin the funding signal window only after the correction stage, or exclude the reveal-induced transient from the window.
Pay on an aligned tax base. Positions opened in the concealed batch do not receive the imminent event. Alternatively, receiving notional accrues continuously over the same post-reveal window used to measure the signal rather than at one final timestamp.
The rule can be implemented in several ways. A chain can add a reveal then clear subround. An application can delay oracle sampling by a fixed or state dependent number of blocks. A protocol native arbitrage module can rebalance against an external price before funding is finalized. Or the funding contract can determine event eligibility from a pre-batch snapshot and accrue newly opened positions only from the next event. These mechanisms differ in liveness and market-quality costs, but they target the two channels identified above.
6.2 An explicit correction buffer↩︎
Suppose that, at reveal, the residual hidden order distortion is \(y\) and that its conditional mean satisfies \(z_t\leq y e^{-\rho t}\) after reveal for some \(\rho>0\). The application waits \(L\) and then measures over a window of length \(W\). In the absence of further hidden intervention, the expected average measured distortion satisfies \[\bar z_{L,W} \leq y\,h(L;\rho,W), \qquad h(L;\rho,W) :=e^{-\rho L}\frac{1-e^{-\rho W}}{\rho W}. \label{eq:buffer-response}\tag{25}\]
Theorem 2 (Decryption aware dollar bound). Assume:
the residual hidden order distortion at reveal has local creation cost \(ay^2\);
the conditional mean distortion after reveal decays at exponential rate at least \(\rho\);
signal to payment pass-through is at most \(\tau\);
endowed receiving notional is at most \(\overline{N}\);
positions created in the concealed batch are ineligible for the current event.
Then the maximum expected incremental funding value generated by the concealed batch residual distortion is bounded by \[\varepsilon_{\mathrm{priv}}(L) = \frac{m^2\overline{N}^2\tau^2}{4a} e^{-2\rho L} \left(\frac{1-e^{-\rho W}}{\rho W}\right)^2. \label{eq:privacy-bound}\qquad{(10)}\] For every \(\varepsilon>0\), to guarantee \(\varepsilon_{\mathrm{priv}}(L)\le\varepsilon\), it is sufficient to choose \[L\ge \frac{1}{2\rho} \left[ \log\left[ \frac{m^2\overline{N}^2\tau^2}{4a\varepsilon} \left(\frac{1-e^{-\rho W}}{\rho W}\right)^2 \right] \right]_+. \label{eq:buffer-rule}\qquad{(11)}\]
Proof. Under the stated eligibility rule, concealed batch entry does not contribute created notional to the current event, so the privacy specific tax base amplification term is absent. Proposition 3 applies with response factor at most \(h(L;\rho,W)\) and \(N_0\le\overline{N}\), yielding ?? . Solving the inequality for \(L\) gives ?? . ◻
The theorem bounds the incremental transfer generated by the concealed batch residual. It does not claim that all post-reveal manipulation disappears. An attacker can continue trading publicly after reveal, those trades belong in the ordinary oracle manipulation and dollar security analysis. The role of the buffer is to ensure that the protocol does not grant a special uncorrected payment window solely because the attack was concealed during ordering.
6.3 Why both controls are needed↩︎
A correction buffer and an eligibility rule address different ledgers.
Design |
Signal ledger | Tax base ledger |
|---|---|---|
Immediate post-reveal measurement |
Preserves the reaction gap distortion. | Concealed entrants may receive the event. |
Correction buffer only |
Reduces \(g\) or \(h(L)\). | A final timestamp rule can still make entry cheap. |
Eligibility lag only |
Removes same batch created notional from the event. | Endowed notional still profits from an uncorrected signal. |
Reveal correct measure pay |
Lets adaptive arbitrage act before measurement. | Excludes concealed entrants or accrues notional over the public measurement window. |
Exogenous non-manipulable oracle |
Removes or sharply weakens the self-authored signal channel. | Tax base timing still matters for predictable transfers. |
An eligibility lag alone sets the privacy specific created notional coefficient \(q\) to zero but leaves \(q_0\) intact for endowed positions. A signal buffer alone reduces both \(q_0\) and \(q\) but can leave \(\zeta\) near zero for a timestamp entrant. The combined rule is therefore the natural application level composition of transaction privacy with a state contingent transfer.
7 Numerical illustrations and design implications↩︎
Table 2 reports dimensionless reaction gap effects with no closed stage correction. The first ratio is the measured distortion multiplier \(R_g\); the second is the endowed notional value multiplier when \(m\) is unchanged; the final column is the fraction of public targeting ability the attacker must retain for encryption to increase endowed attack value.
| \(\rho W\) | \(\delta/W\) | \(R_g\) | \(R_g^2\) | critical \(m_{\Enc}/m_{\Pub}\) |
|---|---|---|---|---|
| 2 | 0.10 | 1.197 | 1.432 | 0.836 |
| 8 | 0.05 | 1.400 | 1.960 | 0.714 |
| 8 | 0.10 | 1.800 | 3.239 | 0.556 |
| 20 | 0.05 | 2.000 | 4.000 | 0.500 |
| 20 | 0.10 | 3.000 | 9.000 | 0.333 |
Several design implications follow.
7.0.0.1 Fast decryption is necessary but not sufficient.
Low cryptographic overhead improves user latency and reduces one component of wall clock delay. But if the application closes adaptive admission before reveal, the remaining one round ordering barrier can still be material. A systems benchmark should therefore report not only proposal to execution latency but also the earliest stage at which a transaction contingent on the revealed state can execute.
7.0.0.2 Protocol native correction is especially valuable under privacy.
A precommitted arbitrage module, solver auction, or state rebalancing hook can move correction capacity from \(\mathcal{A}\) into \(\mathcal{C}\). Moving a fully covered type \(i\) in this way raises \(\rho_c\) by \(\nu_i\theta_i\) while leaving \(\rho_p\) unchanged. It therefore narrows the correction deficit during the reaction gap. Adding a new correction technology that remains active in both stages raises both rates. Reducing \(\delta\) attacks the timing margin directly. Which agents can supply these forms of correction is itself shaped by order flow and searcher competition in block building [37], [38].
7.0.0.3 Randomized permutation mainly acts through \(m\).
Permutation can make a manipulator less certain about relative order and interactions with other hidden transactions, lowering targeting retention. This can be strongly protective. It does not automatically restore an adaptive correction opportunity after the plaintext is known. In the model, permutation primarily lowers \(m\); a reveal then clear stage primarily lowers \(g\) and raises effective visibility \(v\). The controls are complementary.
7.0.0.4 Long funding windows do not make the issue disappear mechanically.
A small \(\delta/W\) can still matter when \(\rho W\) is large. The relevant dimensionless quantity in the fast correction regime is approximately \(\rho\delta\), not merely the fraction of the funding window lost. That said, if the signal is derived from a deep external oracle and the hidden venue transaction barely moves it, the effective \(a\) is large and the channel is weak.
7.0.0.5 Dollar security requires concentration limits.
All attack values scale with \(N_0^2\). An application can reduce the required correction buffer through account, coalition, or market wide limits on receiving notional. A rate cap is not a complete substitute, it bounds basis points, while the dollar transfer still scales with the attackable tax base.
8 Conclusion↩︎
Encrypted mempools remove information from would be attackers, but they also remove information from correctors and competing entrants. For victim dependent MEV, the first effect can dominate. For self-authored state manipulation, the attacker may retain most of the information it needs while the market loses the opportunity to respond. Perpetual funding makes the composition failure visible. A hidden transaction can affect the signal that sets a transfer rate, while endowed or newly created open interest supplies the receiving base.
The correction sector makes the missing market response explicit. The difference \(\rho_p-\rho_c\) is the weighted correction capacity that gains actionable information or execution access after reveal. The reaction gap factor \(g\) prices the delay before that capacity can act. The capitalization coefficient \(\zeta\) prices how much predictable funding is bid into entry. Their combination yields a security decomposition into attacker blindness, correction shielding, and capitalization shielding.
The practical rule is simple. Do not reveal and immediately pay against the revealed state. Reveal, permit correction or clearing, measure after the transient, and align position eligibility with the public measurement window. Transaction privacy and market integrity are compatible, but only when the application is designed for the information schedule that encryption creates.