# Mempool Privacy: An Economic Perspective

Antoine Rondelet and Quintus Kilbourn

###### Abstract

A growing body of literature is aimed at designing private mempools in
blockchains. The ultimate goal of this research is addressing several
phenomena broadly classed under MEV with sandwich attacks as the canonical
example. The literature has primarily viewed MEV as a problem arising from
oversights in distributed systems and cryptographic protocol design and has
attempted to address it with the standard tool sets from those disciplines.
This paper argues that the impact of private mempools on markets and agent
incentives renders analyses that do not consider the economic lens incomplete.
The paper presents several observations across blockchains and traditional
finance to justify this argument and highlight specific dynamics for future
study.

##  1 Introduction

Privacy has been a theme intertwined with blockchains since their inception in
the form of Bitcoin [62]. Blockchains have both been deeply connected with
financial applications - use cases which often necessitate privacy - and
relied heavily on cryptographic tools and the cryptographic community. One
particular area of development in this larger push has been ensuring the
privacy of transactions which have not yet been executed, dubbed "mempool
privacy."

While mempool privacy is naturally relevant when user actions are intended to
be hidden indefinitely, much recent work has focused on an ephemeral notion of
privacy which sees information about transactions partly or fully revealed
after being executed. The main setting for such privacy is smart contract
blockchains of which Ethereum is emblematic.

The importance of mempool privacy to smart contract blockchains can be
understood from two perspectives: the functioning of blockchains as an
"infrastructure layer" and the optimal functioning of the financial markets in
the "application layer" above. The importance of mempool privacy to smart
contract blockchain infrastructure became clear in 2019 with the publication
of "Flash Boys 2.0" [29], which introduced the concept of MEV (Maximal
Extractable Value). The paper detailed how information about unexecuted
transactions in the Ethereum mempool, in part, was leading to a variety of
behaviours which congested Ethereum, increased the incentive for chain forks
and saw some users profiting at the expense of others. These and similar
phenomena, some of which lead to the crash of other blockchains [34, 60, 64],
propelled the study and mitigation of MEV into a field in its own right [100]
\- a field which has naturally placed an emphasis on mempool privacy.

To give context on scale, we can turn to transfers of value attributed to MEV.
In the last year, over 300 000 ETH (just under half a billion dollars
according to the prices at writing, Sept ’23) has been transferred to the
Ethereum validator set due to MEV activity [32], a lower bound of the scale of
total value transfer.

From a traditional financial perspective, the importance and impact of privacy
of unexecuted financial operations is a well-studied topic in practice, in the
literature and the regulatory frameworks. For example, many large exchanges
offer trade types like iceberg orders [22] which allow traders to obscure the
quantity while exposing the price at which they are willing to trade. Other
trading venues, known as dark pools, differentiate themselves through privacy
[102]. Financial markets researchers have also developed a rich literature
investigating the relationship between privacy and market outcomes. For
example, some research has investigated the market properties under which
foregoing trade privacy may be desirable [83, 41, 31, 3] while other research
has investigated the optimal means by which a competing trader’s lack of
privacy can be exploited [10, 16]. On the regulatory front, regulations such
as FINRA 5270 in the United States strictly prohibit financial service
providers from acting on information about unexecuted trades.

Examples from the traditional financial industry also provide insight into the
extremes to which traders will go to acquire access to information which has
not been incorporated into the market. For instance, in the recent past, some
firms have paid to acquire satellite images of Walmart parking lots in order
to count parked cars as an indication of stock value [39] while hundreds of
millions of dollars were spent laying a cable between New York and Chicago for
a 3ms reduction in roundtrip time between exchanges [18]. Not only should
blockchain designers expect similar dedication to information extraction, we
should expect small details to have substantial impact on the market
structure.

Just like MEV in the blockchain context, the lessons from traditional finance
point to the pivotal role which the privacy of unexecuted transactions can
play in decentralised finance. In some sense, the economic lens has been
applied to what is now being labelled as "mempool privacy" for decades.
However, in another sense, the economics of mempool privacy have gone with
little attention. Traditional financial settings do not have validators who
are able to produce empty blocks, gossip networks, decryption phases or near-
Turing-complete transactions. Instead of traditional finance’s regulated third
parties, blockchain designers have goals of censorship resistance and
decentralisation. The lack of distributed systems and cryptographic context in
this relevant economic research and the overemphasis on distributed systems
and cryptographic design in blockchain-native work points to a gap in
understanding which must be filled.

###  1.1 Our Contributions

Thus far, formal research into mempool privacy has mostly taken a distributed
systems or cryptographic lens. As the issues being addressed are fundamentally
economic in nature, solutions that do not consider the economic perspective
may fail to address or aggravate targeted issues. This paper relates and draws
from observations in blockchains in production as well as financial markets to
highlight several economic dynamics which require further study and
consideration when designing private mempools. In particular, the paper
addresses (1) the impact of mempool privacy on user behaviour and how this
impacts network congestion and security guarantees; (2) the impact of mempool
privacy on validator incentives as they pertain to censorship, decryption
delays and collusion and; (3) the impact of mempool privacy on DeFi markets,
using liquidations as a motivating example.

##  2 Preliminaries

###  2.1 Mempool Privacy

This paper deals with private mempools and the associated concept of "mempool
privacy" or "pre-execution privacy". Unlike in traditional finance, in which
execution and settlement have exact legal meanings [55, 45], the terms are
harder to pin down in the blockchain context. As such, we work with an
operative definition of execution.

###### Definition 1

A blockchain transaction is classified as executed if the transaction is valid
and no single party or small group of parties is able to change the outcome of
the transaction, where the outcome of the transaction is a transition in the
blockchain state machine.

A transaction is thus "pre-execution" if the transaction is valid, but a
validator or other party is able to influence which state transition it
engenders in the view of the broader network. There certainly are some
important unanswered questions surrounding notions of execution, but the
definition is sufficient for the purposes of this paper.

Having defined execution, we are now able to define mempool privacy.

###### Definition 2

A blockchain satisfies the property of mempool privacy if the sender of a
transaction is able to hide some or all of the content of a transaction until
it is considered executed.

Clearly, this is not a rigorous cryptographic definition and leaves the exact
nature of the "content" being obscured under-defined. This vagueness is partly
intentional as different mempool designs target slightly different properties
and the given definition is sufficient for the purposes of this paper. A
useful framing for the notion of mempool privacy is as relatively more private
compared to the status quo on the most widely used blockchains like Ethereum.
The status quo being that transactions are propagated completely in plaintext
with the state transitions they engender easily accessible to the block
producer (i.e. the validator or miner selected who produces the next block) if
not a larger set of agents. A similar definition of mempool privacy can be
found in [13] which specifically requires that transactions are encrypted and
emphasises inclusion in a block as opposed to execution.

###  2.2 Motivations For Mempool Privacy

Although not exhaustive, there are two commonly-cited reasons that mempool
privacy is desirable, all of which are often lumped under the umbrella of MEV.

####  2.2.1 Asymmetries

Currently, popular blockchains use consensus algorithms which allocate the
role of producing the next block to a single validator (or miner in proof of
work algorithms). This is true of Gasper on Ethereum[19], Tendermint or
CometBFT in Cosmos chains [17], Solana consensus[99], Hotstuff[101], Avalanche
consensus and many more. The absence of mempool privacy in combination with an
ephemeral monopoly over transactions ordering and inclusion creates an
information and power asymmetry between the block producing node and users who
necessarily must expose the content of their transactions to the block
producer before they are executed. This allows the block producer to engage in
"frontrunning" and "sandwiching" [49] among other activities.

Proponents of mempool designs which seek to curb this asymmetry cite
unfairness as a primary motivation [48, 47, 58]. Such arguments have given
rise to notions of fairness such as

Receive-Order Fairness which considers ordering transactions in the order by
which they are received by the network as fair [47].
Blind-Order Fairness which considers transaction ordering being conducted
without any knowledge of the content of transactions as fair [58]. Note, that
this is less restrictive than receive-order fairness as the block producer is
still able to reorder transactions.

Fairness-based criterion are not unique to blockchain markets and are often
discussed in traditional markets, often with regard to the protection of
unsophisticated "retail" traders [56, 76].

The aforementioned information asymmetry can also be deemed undesirable from
an economic efficiency or market neutrality perspective. As an example of
economic inefficiency, sandwich attacks can increase the cost to trade,
inhibiting efficient allocations. Censorship, broadly defined as the delayed
or denied execution of a valid transaction, is a commonly presented example of
market neutrality being violated. Such censorship could be politically
motivated [93] or driven by economic reward [75]. Delaying posting of
collateral, liquidations [81] or oracle updates are basic examples of
behaviours which can both be profitable for the validator and threaten the
correct functioning of market deployed on the blockchain.

####  2.2.2 Externalities of Strategic Use

Current blockchain implementations are resource constrained. As observed in
[29], public mempools can lead to dynamics such as Priority Gas Auctions
(PGAs) in which users pursuing the same profitable opportunity on the
blockchain (e.g. a liquidation) will rapidly respond to each other’s pending
transactions in an attempt to outbid competition pursuing the same opportunity
in what resembles an English auction. The net effect is a heavily congested
network layer, blocks filled with many failed transactions and elevated fees
for accessing the blockchain.

###  2.3 Encrypted Mempool Design Space

It is useful to highlight several important dimensions of the private mempool
design space. Naturally, there are many details to consider, but the
dimensions listed below are relevant insofar as they relate to economic
considerations outlined in 3.

####  2.3.1 Underlying Cryptography

There are several cryptographic primitives which have been utilised in
different design proposals. Outside of the receive-ordering work, all
encrypted mempool designs that the authors are aware of attempt to ensure
decryption only occurs after the content of a block has been finalised (i.e.
after the transaction has been executed). As elaborated in 2.4, designs in
which users encrypt to a threshold public key [13, 58, 8, 7, 80] are popular
as threshold honesty assumptions often resemble the honesty assumptions of the
underlying consensus protocol. Trusted Execution Environments (TEEs) have also
been proposed in conjunction with commit reveal schemes [11, 33]. The use of
timelock encryption [85] and commit-reveal schemes [40, 92] have also been
proposed.

Importantly, these primitives can be combined and used in different ways. An
in-depth comparison of this component of the design space falls outside the
scope of this paper as many of the arguments raised in 3, the core of this
paper, apply independent of underlying cryptographic primitives and schemes.

####  2.3.2 Denial-of-Service Resistance

As blockchains generally allow any actor to enter messages into the mempool,
nodes which propagate these messages are susceptible to being overloaded with
very high message loads. Cheap deduplication and validity checks are common
techniques to defend against such forms of attacks [53]. While the exact
nature of the validity check varies between blockchain implementations, the
general approach of verifying that a transaction pays a requisite fee is
universal as this compensates the network for resource usage and imposes costs
on would-be attackers.

Unfortunately, a naive implementation of mempool privacy in which too much
information is obscured prohibits such validity checks. An easy workaround is
to make sender account information available so that ownership of sufficient
funds to pay fees can be efficiently verified. This comes at the expense of
privacy for the sender’s account, e.g. [13]. Another approach which avoids
this tradeoff is to attach a cryptographic proof that a ciphertext corresponds
to a valid transaction [43]. However, computing and verifying such proofs may
introduce overhead with significant impact in latency-sensitive trading
environments. Additionally, special restrictions must be put in place to
ensure that the same funds are not used to generate multiple proofs exceeding
the value of the funds in aggregate. We have yet to see a proof-based DoS-
resistance mechanism that is suitable for smart contract blockchains.

Considering means for DoS resistance points to a larger question of what
information to leave accessible and what to obfuscate. Tradeoffs around this
are discussed further in 3.

####  2.3.3 Optionality

While the concept of shielded and transparent transactions exist in certain
private blockchains such as ZCash [43], the idea of allowing users to choose
the privacy parameters of their transactions has not been thoroughly discussed
in the context of smart contract chains. Standard motivations for this kind of
optionality are based around users seeking to comply with regulatory
requirements, but there are additional motivations in terms of users avoiding
costly overhead from encryption schemes, seeking faster settlement and
intentionally propagating information to a market of counterparties and
competitors as discussed below. A specific setting in which users are given a
choice to opt in or out of a private mempool is studied in [21].

###  2.4 Private Mempool Literature

Several different designs for private mempools for smart contract blockchains
have been proposed. Among these, Ferveo [13] proposes a threshold encrypted
mempool which aligns closely with the security assumptions of the Tendermint
consensus protocol[17]. A similar paper shows how threshold encryption can be
used to provide mempool privacy in DAG-based blockchains [58]. Addition of
threshold encrypted mempool to production blockchains has also been proposed
[57, 80].

A separate class of solutions have proposed the use of TEE’s. Some solutions
advocate for the use of TEE’s external to the validator set in combination
with a commit-reveal scheme [11, 33], while some blockchains which are already
live require validators to run TEEs themselves [66, 98, 67]. Other work has
proposed timelock encryption [85] while commit-reveal schemes are proposed in
[40] and in [92] which notably operates under a rational model.

A related branch of literature pursues receive-order fairness, which would
also give a notion of mempool privacy [47, 48, 44]. Notably, the feasibility
and welfare implications of such a property have been met with criticism [6,
89].

##  3 Economic Considerations

This is the main section of the paper which outlines some economic dynamics
around private mempools which are both not well understood and impactful,
necessitating further research. While specific implementations of blockchains
with private mempools will have their own idiosyncracies, the questions and
observations below are intended to apply broadly and should serve as
inspiration for research tailored to particular settings.

###  3.1 User Incentive Compatibility

The implementation of an encrypted mempool does not imply that users will
engage with the protocol as intended. Sending unencrypted information to
middlemen, generating large numbers of transactions with a high probability of
failure on execution or exposing information about a ciphertext to the block
producer or the public are all examples of such behaviour.

####  3.1.1 Inefficient Resource Consumption

In 2.2.2 PGA’s are listed as a phenomenon partly caused by the public nature
of Ethereum’s mempool, which strains limited network resources. In priority
gas auctions, rapid submission of transactions in response to those submitted
by competitors can congest the gossip network. The obfuscation of competing
transactions can address this by removing the information which triggers
competitive responses, although, as explained in 2.3.2, some proposed
approaches to DoS-resistance do not obscure key information like fees, which
can trigger this kind of iterative bidding behaviour.

That said, addressing the escalating bidding of PGA’s is but one part of the
larger problem of competitive dynamics wasting network resources. PGA’s see
users speculatively submitting transactions knowing that there is some
probability of their transaction capturing a profitable opportunity. As [29]
notes, the consequence of this speculation is that blocks of limited size can
contain significant numbers of failed transactions. The uncertainty as to
whether a user will be able to exercise an opportunity in PGA’s depends on
bidding behaviour and network latency of competitors. When privacy is
introduced, there is additional uncertainty about the existence and nature of
opportunities in the first place, potentially leading to more failed
transactions being included in blocks (which also add to gossip network
congestion).

To find concrete examples of this phenomenon, we can turn to Solana [99] a
low-latency blockchain which does not have a public mempool as transactions
are directly forwarded to the block producer. Instead of waiting for a
transaction which engenders an arbitrage or liquidation opportunity to be
executed and only then reacting, sophisticated users of Solana optimistically
send transactions which attempt to capture an opportunity before its existence
is even publicly known [24]. This is part of a larger trend, partly fueled by
low fees, in which 95% of Solana arbitrage transactions fail, making up more
than 20% of transactions on Solana in 2022 according to a Solana industry
leader[51].

Further research is needed to understand the relationship between mempool
privacy, fee markets and speculative transaction submission. The most notable
responses from industry have come in the form of the block builder role in
Ethereum which commonly provides the service of simulating and excluding
failed transactions and Jito Labs’ Block Engine on Solana which provides a
similar service and artificially creates a public mempool where there was none
before [52].

####  3.1.2 Intentional Information Revelation and Intermediaries

Phenomena like sandwiching [49] have been taken to motivate a position that
privacy must necessarily improve user execution. However, upon further
consideration this does not hold in general. Consider the basic example of
four trades, two buys and two sells of the same asset pair, being ordered in a
block. Blind ordering attaches some probability to the ordering of <buy, buy,
sell, sell> which may see the second and fourth transaction fail as prices
have been moved out of acceptable ranges. An alternating ordering doesn’t have
this effect, leaving users an incentive to circumvent blind ordering.

This example should be enough to illustrate the basic point that users may
prefer less-than-full privacy, but there is actually a wealth of evidence to
support this point. Traditional finance is full of examples of pre-execution
information revelation. Some traders may be incentivised to publicly announce
their trade intentions in what is known as "sunshine trading" [83, 41, 31]
while request-for-quote (RFQ) systems often involve traders exposing some
information like asset pair and quanitity while obscuring the direction of
their trade as part of a counterparty discovery process.

As trading environments are replicated in the blockchain setting, we should
expect these incentives to reveal pre-execution information to be replicated
as well. The question is how this would occur concretely.

Structures like the RFQ’s mentioned above are already well established in
blockchain. In fact, very large amounts of DeFi volume on Ethereum flow
through at least one intermediary that provides some services to improve
execution quality, often never entering the public mempool [38, 90, 59]. Block
builders like Flashbots or Titan builder; and auction systems like 0x, 1inch,
CoWswap, MEV-share and MEV-blocker are prevalent examples of such services.
Notably, Uniswap, the largest decentralised exchange on Ethereum, recently
announced the deployment of such an RFQ system to service all users
interacting with their front end [2].

On one hand, the existence and usage of such intermediaries is beneficial to
blockchain systems because of the additional features and improved execution
quality presented to users. On the other, however, the usage of these
intermediaries can erode the guarantees blockchains aim to provide users. The
properties of decentralisation may be weakened if effective use of the
applications deployed on the blockchain rely on the services of a trusted
intermediary, forcing users to choose between execution quality and security.
This isn’t an effect isolated to individual users as there are network effects
to trading activity, with popular venues being more appealing [30].

The connection between these intermediaries and mempool privacy is that the
degree and nature of reliance on intermediaries depends on the structure of
the underlying protocol. Intermediaries are unlikely to replicate
functionality the underlying blockchain already provides. For instance, users
who currently rely on intermediaries for forms of trusted privacy can use the
public mempool under mempool privacy. Altneratively, users who seek to
credibly reveal information about their unexecuted transactions are more
likely to use intermediaries to do so if the underlying protocol doesn’t
support the (full or partial) revelation the user is after.

Similarly, the trust assumptions implied when using an intermediary will vary
depending on details of the underlying blockchain. It is common for
intermediaries to aggregate transactions (or cryptographic messages of other
formats) from users into what is known as "bundles" on Ethereum before passing
these on to other intermediaries (e.g. [96]). Currently, on Ethereum, the
second intermediary (or an attacker that compromises the intermediary [61]) is
in a position to decompose bundles, using these for unintended state
transitions. If the underlying blockchain’s signature scheme supports a form
of aggregation, users are protected from unbundling.

Such a relationship between the protocol and surrounding intermediaries calls
for protocol design which explicitly reasons about the existence of
intermediaries including users’ incentive to rely on them and the properties
that the entire system can guarantee. A clear starting point in varying
private mempool designs would be providing users meaningful degrees of freedom
in choosing what information is obfuscated, perhaps allowing for ciphertext
transactions to be accompanied with proofs about properties of the preimage.
This allows both for control over information revelation to the market at
large, but also to intermediaries.

Some work on this intermediary-aware blockchain interface has already begun in
industry. The Ethereum community has started working on standards to
facilitate the easy use of some intermediary services in the form of proposals
like ERC4337 (a message standard that uses BLS signatures) and proposer-
builder separation (a commit-reveal scheme) [96, 95, 63]. The Anoma
architecture has also been designed to reason explicitly about private pre-
execution counterparty discovery through the use of tools like zero-knowledge
proofs [37].

###  3.2 Validator Incentive Compatibility

Validators (or miners) perform essential tasks such as acting as block
producers, voting on blocks and, under some designs, acting as a threshold
decryption committee. Apart from [21] which investigates the setting in which
validator participation in private mempools is optional, little work has gone
into understanding how introducing mempool privacy impacts validator
incentives.

An important delineation to make is that mempool privacy does not necessarily
prevent block producers from influencing the inclusion and ordering of
transactions and being compensated for doing so. For example, a user may
prefer to have their transaction execute first in a block as this guarantees
access to identified opportunities. Ordering policies are outside the scope of
this work.

####  3.2.1 Censorship

In 2.2.1, the connection between neutrality, in particular the inclusion of
valid transactions, and mempool privacy was outlined. Apart from the obvious
point that it is more difficult to censor transactions according to certain
criteria if the information for evaluating those criteria is not available,
there are two dynamics to highlight.

The first thing to point out is that not all information is necessarily
obscured. This could be due to the protocol design (e.g. for DoS resistance),
but also due to users voluntarily exposing information in pursuit of better
execution guarantees (see 3.1.2). The latter may force users who are targets
of censorship to resort to less efficient (fully private) means of using the
blockchain, an improvement over censorship but still short of a neutral
platform.

The second notable dynamic is that block producers may be incentivised to
censor broad groups of transactions if censoring individual transactions is
not feasible. Block producers are generally afforded the option to produce an
empty block, which represents an extreme option. Other forms of information
available can result in finer selection, which in turn changes users’
incentives to participate in privacy schemes as they seek to reveal
information that differentiates their transactions from those targeted by a
censorship policy.

Research is needed to understand this dynamic and how it interfaces with other
aspects of the blockchain design, such as the network behaviour when an empty
block is produced (e.g. is the leader rotated? is the next leader known?) or
where transactions fees go (e.g. Ethereum’s EIP1559 mechanism does not pay the
block producer, reducing incentives for transaction inclusion).

####  3.2.2 Collusion

Numerous designs across academia and industry [7, 80, 86, 88, 9, 13, 58] have
proposed the use of threshold encryption schemes to implement mempool privacy.
The justification is often that honest-majority thresholds can be set to mimic
those of the underlying protocol (e.g. $\frac{2}{3}$ for Tendermint). This
justification, however, does not sufficiently weigh the fact that some
deviations from honest behaviour such as double-signing, are detectable and
attributable and can be disincentivised through the threat of seizing
collateral ("slashing") and reputational damage; while other deviations such
as early decryption of encrypted transactions can be neither, removing such
disincentives.

One research direction is modeling these external incentives and proposing
methods for monitoring for misbehaviour, as has been proposed in industry for
other forms of misbehaviour [42]. Traditional financial markets have many
examples of collusion to manipulate markets for profit. Examples include the
Libor scandal [74] foreign exchange rate manipulation scandal [54], municipal
bond rigging [65], ISDAFIX scandal [36, 23] and metals price-fixing scandal
[46, 82].

####  3.2.3 Information Asymmetries

Due to non-zero propagation delays, some party must learn about the decrypted
information first. Due to the valuable nature of information in financial
markets, this may constitute a valuable asymmetry. Thus, there is a clear
incentive for parties who learn information first to delay propagation,
increasing the length of this asymmetry. A similar dynamic has already been
studied in the context of Ethereum in which a block producer is incentivised
to delay the production of their block as this increases its value due to the
continued arrival of transactions [84]. The conclusion was that the incentives
for this behaviour were present, although not currently acted upon.

Extensions of this research are required to evaluate various private mempool
designs, the conditions under which there are incentives to delay information
revelation and the means to disincentivise such delays.

###  3.3 Market Impact

The interactions between mempools and the applications which ultimately rely
on them certainly depends heavily on the nature of the applications which are
deployed. A large body of financial literature investigates the impact of the
introduction of private trading venues, "dark pools", on price discovery,
trader welfare and price spreads (difference between best buy and sell prices)
[15, 102, 20]. The extent to which this research translates well to the
blockchain setting depends on model assumptions and blockchain market design.
There is, however, good reason to believe that the introduction of privacy
will impact decentralised exchanges. Other financial primitives like lending
are certainly also likely to be affected, as discussed below.

####  3.3.1 Liquidations

Lending is a fundamental financial activity which is common in DeFi in the
form of applications like Aave and Compound [1, 25]. These applications rely
heavily on the use of collateral to secure loans. As the value of the
collateral relative to the loaned assets fluctuates with time, it is often
necessary for these applications to sell collateral to clear bad debt in what
is known as a _liquidation_ [81], a process which relies on external agents to
purchase the collateral. In times of rapid price movements in which the
relative value of the collateral is steeply declining, it is important for
lenders to be able to liquidate collateral quickly in order to avoid bad debt.

In blockchains with transparent mempools like Ethereum, it is common for
liquidations to be executed in the same block in which the collateral becomes
eligible for liquidation. Usually, this is due to an oracle update or a price-
moving transaction. However, in settings where the existence of transactions
triggering price movements are only known after they have been executed,
liquidators can only act in the next block after discovering this information
while the price on other venues like centralised exchanges continue to move.

Naturally, there are some counter-forces to these effects such as the
speculative transactions explained in 3.1.1. The bottom line, however, is that
less efficient liquidations necessitate higher collateral requirements
reducing capital efficiency (i.e. the utility of the lending protocol) and,
since mempool privacy can impact the efficiency of liquidations, the
relationship between liquidations and privacy requires further investigation.

##  4 Conclusion

This paper has argued that private mempools must be analysed through an
economic lens. Such an economic analysis has been motivated by highlighting
how the introduction of mempool privacy can impact the incentives and
behaviour of agents that use and comprise a blockchain in undesirable ways,
threatening system security and the efficiency of DeFi markets. The paper has
aimed to stimulate research at the intersection of cryptography, distributed
systems and economics by proposing several open areas of study in the design
of private mempools.

## References

  * [1] “Aave”, 2023  URL: aave.com
  * [2] Hayden Adams  “UniswapX”  In _UniswapX Whitepaper_ , 2023  URL: https://uniswap.org/whitepaper-uniswapx.pdf
  * [3] Anat R. Admati and Paul Pfleiderer  “Sunshine Trading and Financial Market Equilibrium”  In _The Review of Financial Studies_ 4.3 [Oxford University Press, Society for Financial Studies], 1991, pp. 443–481  URL: http://www.jstor.org/stable/2961968
  * [4] Sunny Aggarwal  “Threshold Decrypted Transactions: Thwarting Front-Running and Enabling Privacy at the Protocol Level ” [Online; accessed May-2023], https://www.youtube.com/watch?v=6WrFlsDSUYg, 2021
  * [5] Sunny Aggarwal and Dev Ojha  “Osmosis governance stance against off-chain harmful MEV collusion and extraction software” [Online; accessed May-2023], https://gov.osmosis.zone/discussion/7812-osmosis-governance-stance-against-offchain-harmful-mev-collusion-and-extraction-software, 2022
  * [6] Guillermo Angeris and Theo Diamandis  “A Note on the Welfare Gap in Fair Ordering”, 2023  URL: https://angeris.github.io/papers/note-on-fifo.pdf
  * [7] Anoma  “anoma/ferveo” [Online; accessed April-2023], https://github.com/anoma/ferveo, 2023
  * [8] Avi Asayag et al.  “A Fair Consensus Protocol for Transaction Ordering”, 2018, pp. 55–65  DOI: 10.1109/ICNP.2018.00016
  * [9] Avi Asayag et al.  “Helix: A Scalable and Fair Consensus Algorithm Resistant to Ordering Manipulation”  In _IACR Cryptol. ePrint Arch._ , 2018, pp. 863  URL: https://eprint.iacr.org/2018/863
  * [10] Mukarram Attari, Antonio S. Mello and Martin E. Ruckes  “Arbitraging Arbitrageurs”  In _The Journal of Finance_ 60.5, 2005, pp. 2471–2511  DOI: https://doi.org/10.1111/j.1540-6261.2005.00805.x
  * [11] Kushal Babel, Yan Ji, Mahimna Kelkar and Ari Juels  “Prof: Fair transaction-ordering in a profit-seeking world”  In _Medium_ IC3, 2023  URL: https://initc3org.medium.com/prof-fair-transaction-ordering-in-a-profit-seeking-world-b6dadd71f086
  * [12] Billy Bambrough  “‘Market Manipulation And Insider Trading’—Elon Musk And Tesla Are Facing A Fresh Nightmare Challenge” [Online; accessed June-2023], https://www.forbes.com/sites/digital-assets/2023/06/03/market-manipulation-and-insider-trading-elon-musk-and-tesla-are-facing-a-fresh-nightmare-challenge/, 2023
  * [13] Joseph Bebel and Dev Ojha  “Ferveo: Threshold Decryption for Mempool Privacy in BFT networks”  In _IACR Cryptol. ePrint Arch._ , 2022, pp. 898  URL: https://eprint.iacr.org/2022/898
  * [14] Bloomberg  “Index Methodology - Bloomberg Galaxy Crypto Index” [Online; accessed May-2023], https://assets.bbhub.io/professional/sites/10/Bloomberg-Galaxy-Crypto-Index-Methodolgy-December-2020.pdf, 2020
  * [15] Jonathan Brogaard and Jing Pan  “Dark Pool Trading and Information Acquisition”  In _The Review of Financial Studies_ 35.5, 2021, pp. 2625–2666  DOI: 10.1093/rfs/hhab098
  * [16] Markus Brunnermeier and Lasse Heje Pedersen  In _Predatory trading_ , 2004  DOI: 10.3386/w10755
  * [17] Ethan Buchman  “Tendermint: Byzantine fault tolerance in the age of blockchains”, 2016
  * [18] Eric Budish, Peter Cramton and John Shim  “ The High-Frequency Trading Arms Race: Frequent Batch Auctions as a Market Design Response *”  In _The Quarterly Journal of Economics_ 130.4, 2015, pp. 1547–1621  DOI: 10.1093/qje/qjv027
  * [19] Vitalik Buterin et al.  “Combining GHOST and Casper”, 2020  arXiv:2003.03052 [cs.CR]
  * [20] Sabrina Buti, Barbara Rindi and Ingrid M. Werner  “Dark pool trading strategies, market quality and welfare”  In _Journal of Financial Economics_ 124.2, 2017, pp. 244–265  DOI: https://doi.org/10.1016/j.jfineco.2016.02.002
  * [21] Agostino Capponi, Ruizhe Jia and Ye Wang  “The Evolution of Blockchain: from Lit to Dark”, 2022  arXiv:2202.05779 [q-fin.GN]
  * [22] Riccardo Cesari, Massimiliano Marzo and Paolo Zagaglia  “Effective Trade Execution”, 2012  arXiv:1206.5324 [q-fin.TR]
  * [23] CFTC  “CFTC Announces Multiple Whistleblower Awards Totaling More than $45 Million” [Online; accessed April-2023], 2018  URL: https://www.cftc.gov/PressRoom/PressReleases/7767-18
  * [24] Eugene Chen and Edgar Xi  “MeV on Solana: Umbra research”  In _Umbra Research_ Umbra Research, 2023  URL: https://www.umbraresearch.xyz/writings/mev-on-solana#optimistic-transactions
  * [25] “Compound”, 2023  URL: compound.finance
  * [26] Osmosis Contributors  “Osmosis” [Online; accessed June-2023], https://github.com/osmosis-labs/osmosis/tree/main, 2023
  * [27] Osmosis Contributors  “Setting Up a Genesis Osmosis Validator” [Online; accessed June-2023], https://github.com/osmosis-labs/osmosis/blob/b7fe65f330142102f81ba681c22097aac0f1571c/networks/genesis-validators.md?plain=1, 2023
  * [28] Cosmostation  “Mintscan Osmosis Validators” [Online; accessed June-2023], https://www.mintscan.io/osmosis/validators, 2023
  * [29] Philip Daian et al.  “Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges”  In _CoRR_ abs/1904.05234, 2019  arXiv: http://arxiv.org/abs/1904.05234
  * [30] Carmine Di Noia  “Competition and Integration among Stock Exchanges in Europe: Network Effects, Implicit Mergers and Remote Access”  In _European Financial Management_ 7.1, 2001, pp. 39–72  DOI: https://doi.org/10.1111/1468-036X.00144
  * [31] Magueye Dia and Sébastien Pouget  “Sunshine Trading in an African Stock Market”  In _Managerial Finance_ 37, 2011, pp. 257–274  DOI: 10.1108/03074351111113315
  * [32] Flashbots  “Flashbots Transparency dashboard” [Online; accessed September 2023]  In _Flashbots Transparency Dashboard_ URL: https://transparency.flashbots.net/
  * [33] Flashbots  “The future of MeV is suave: Flashbots”  In _Flashbots Blog RSS_ , 2022  URL: https://writings.flashbots.net/the-future-of-mev-is-suave
  * [34] Solana Foundation, 2021  URL: https://solana.com/news/9-14-network-outage-initial-overview
  * [35] Elijah Fox and Max Resnick  “Multiplicity: A gadget for multiple concurrent block proposers”  In _Ethereum Research_ , 2023  URL: https://ethresear.ch/t/multiplicity-a-gadget-for-multiple-concurrent-block-proposers/14962
  * [36] Garson, Segal, Steinmetz, Fladgate LLP  “Whistleblower Gets Largest-Ever CFTC Award for Exposing the ISDAFIX Scandal” [Online; accessed April-2023], 2018  URL: https://markets.businessinsider.com/news/stocks/whistleblower-gets-largest-ever-cftc-award-for%20-exposing-the-isdafix-scandal-garson-segal-steinmetz-fladgate-llp-1027435727
  * [37] Chris Goes, Adrian Brink and Awa Sun Yin  “Anoma: a unified architecture for full-stack decentralised applications”  In _Anoma Whitepaper_ Heliax, 2022  URL: https://media.githubusercontent.com/media/anoma/whitepaper/main/whitepaper.pdf
  * [38] Tivas Gupta, Mallesh M Pai and Max Resnick  “The centralizing effects of private order flow on proposer-builder separation”, 2023  arXiv:2305.19150 [econ.TH]
  * [39] Kristian Bondo Hansen and Christian Borch  “Alternative data and sentiment analysis: Prospecting non-standard data in machine learning-driven finance”  In _Big Data & Society_ 9.1, 2022, pp. 20539517211070701  DOI: 10.1177/20539517211070701
  * [40] Vero Estrada-Gali˜nanes Haoqian Zhang and Bryan Ford  “Flash Freezing Flash Boys: Countering Blockchain Front-Running”  In _DINPS_ , 2022  URL: https://bford.info/pub/sec/f3b/f3b-dinps22.pdf
  * [41] Lawrence E. Harris  “Order Exposure and Parasitic Traders”, 1997  URL: https://api.semanticscholar.org/CorpusID:167067472
  * [42] Sam Hart  “Accountability along the transaction supply chain”  In _Skip_ , 2023  URL: https://ideas.skip.money/t/accountability-along-the-transaction-supply-chain/89
  * [43] Daira Hopwood, Sean Bowe, Taylor Hornby and Nathan Wilcox  “ZCash Protocol Specification” [Online; accessed April-2023], https://github.com/zcash/zips, 2022
  * [44] IC3  “Order-Fair Consensus: Reducing MEV at the Consensus Layer” [Online; accessed May-2023], 2023  URL: https://medium.com/initc3org/order-fair-consensus-reducing-mev-at-the-consensus-layer-691c98d92127
  * [45] Bank International Settlements  “Principles for financial market infrastructures” [Online; accessed April-2023], https://www.bis.org/cpmi/publ/d101a.pdf
  * [46] Department Justice  “Former J.P. Morgan Traders Convicted of Fraud, Attempted Price Manipulation, and Spoofing in a Multi-Year Market Manipulation Scheme” [Online; accessed April-2023], 2022  URL: https://www.justice.gov/opa/pr/former-jp-morgan-traders-convicted-fraud-attempted-price-manipulation-and-spoofing-multi-year
  * [47] Mahimna Kelkar, Fan Zhang, Steven Goldfeder and Ari Juels  “Order-Fairness for Byzantine Consensus”  In _IACR Cryptol. ePrint Arch._ 2020, 2020, pp. 269
  * [48] Mahimna Kelkar et al.  “Themis: Fast, Strong Order-Fairness in Byzantine Consensus” https://eprint.iacr.org/2021/1465, Cryptology ePrint Archive, Paper 2021/1465, 2021  URL: https://eprint.iacr.org/2021/1465
  * [49] Kshitij Kulkarni, Theo Diamandis and Tarun Chitra  “Towards a Theory of Maximal Extractable Value I: Constant Function Market Makers”, 2023  arXiv:2207.11835 [cs.GT]
  * [50] Jae Kwon and Ethan Buchman  “Cosmos - A Network of Distributed Ledgers” [Online; accessed May-2023], https://v1.cosmos.network/resources/whitepaper, 2023
  * [51] Jito Labs  “Introducing the first Solana Mev dashboard Jito Labs”  In _Jito Labs_ , 2022  URL: https://www.jito.wtf/blog/introducing-the-first-solana-mev-dashboard/
  * [52] Jito Labs  “Jito block engine expands access to all Solana mev traders Jito Labs”  In _Jito Labs_ , 2023  URL: https://www.jito.wtf/blog/jito-block-engine-expands-access-to-all-solana-mev-traders/
  * [53] Kai Li  “Understanding and Hardening Blockchain Network Security Against Denial of Service Attacks” [Online; accessed May-2023], https://surface.syr.edu/cgi/viewcontent.cgi?article=2391&context=etd, 2022
  * [54] Gavin Finch Liam Vaughan and Ambereen Choudhury  “Traders Said to Rig Currency Rates to Profit Off Clients”  Bloomberg, 2013  URL: https://www.bloomberg.com/news/articles/2013-06-11/traders-said-to-rig-currency-rates-to-profit-off-clients#xj4y7vzkg
  * [55] Nancy Liao  “On Settlement Finality and Distributed Ledger Technology” [Online; accessed May-2023], 2017  URL: https://www.yalejreg.com/nc/on-settlement-finality-and-distributed-ledger-technology-by-nancy-liao/
  * [56] Commissioner Jaime Lizárraga  “Statement: Increasing Market Fairness and Efficiency for Investors” [Online; accessed April-2023], https://www.sec.gov/news/statement/lizarraga-statement-cycle-021523
  * [57] Jannik Luhn  “Shutterized Beacon Chain”  In _Ethereum Research_ , 2022  URL: https://ethresear.ch/t/shutterized-beacon-chain/12249/5
  * [58] Dahlia Malkhi and Pawel Szalachowski  “Maximal Extractable Value (MEV) Protection on a DAG”, 2022  DOI: 10.48550/arXiv.2208.00940
  * [59] Blair Marshall  “The false narrative of Mev Protection: How private transactions can result in a poorer settlement than sending publicly”  In _Blocknative_ URL: https://www.blocknative.com/blog/mev-protection-negative-settlement
  * [60] Daniel D. McKinnon  “All is fair in Arb and MeV on avalanche C-chain”  In _ddmckinnon.com_ Daniel D. McKinnon, 2022  URL: https://www.ddmckinnon.com/2022/11/27/all-is-fair-in-arb-and-mev-on-avalanche-c-chain/
  * [61] Bert Miller  “Post mortem: April 3rd, 2023 mev-boost relay incident and related timing issue”  In _The Flashbots Collective_ , 2023  URL: https://collective.flashbots.net/t/post-mortem-april-3rd-2023-mev-boost-relay-incident-and-related-timing-issue/1540?u=quintus
  * [62] Satoshi Nakamoto  “Bitcoin: A Peer-to-Peer Electronic Cash System”, 2009  URL: https://bitcoin.org/bitcoin.pdf
  * [63] Mike Neuder  “Why enshrine proposer-builder separation? A viable path to ePBS”  In _Ethereum Research_ , 2023  URL: https://ethresear.ch/t/why-enshrine-proposer-builder-separation-a-viable-path-to-epbs/15710
  * [64] Patrick O’Grady  “Apricot Phase Four: Snowmanplusplus and reduced C-chain transaction fees” [Online; accessed June-2023], 2021  URL: https://medium.com/avalancheavax/apricot-phase-four-snowman-and-reduced-c-chain-transaction-fees-1e1f67b42ecf
  * [65] James O’Toole  “Bankers nabbed in bid-rigging scandal” [Online; accessed April-2023], 2012  URL: https://money.cnn.com/2012/09/18/news/companies/banks-bid-rigging/index.html
  * [66] “Oasis Network”  URL: https://oasisprotocol.org/developers#overview
  * [67] “Obscuro”  URL: https://obscu.ro/
  * [68] Dev Ojha  “Threshold Decryption for Mempool Privacy” [Online; accessed May-2023], https://docs.google.com/presentation/d/1l57hdy59x54mmgYetsfIdbds2-FOzTIuZ276caZn6g4, 2021
  * [69] Dev Ojha  “ZKVs Cosmos Privacy & ZKP Showcase - Threshold Decryption for mempool privacy with Dev Ojha” [Online; accessed May-2023], https://www.youtube.com/watch?v=7q_uvvKmqrY&list=PLj80z0cJm8QGNPbPJ2adQhN5W890O7YMr, 2021
  * [70] Dev Ojha, Sunny Aggarwal, Tarun Chitra and Anna Rose  “Episode 188: Analyzing Osmosis & Preventing MEV with Sunny and Dev” [Online; accessed May-2023], https://zeroknowledge.fm/188-2/, 2021
  * [71] Osmosis  “Osmosis ProtoRev by Skip Protocol” [Online; accessed July-2023], https://osmosis.zone/blog/osmosis-protorev-by-skip-protocol-on-chain-app-directed-arbitrage, 2023
  * [72] Osmosis  “Osmosis R&D Projects” [Online; accessed May-2023], https://hackmd.io/@osmosis/B1mmhyhFO, 2021
  * [73] Osmosis  “Protocol-Owned Builders, The Future of Sovereign Cosmos MEV” [Online; accessed May-2023], https://osmosis.zone/blog/protocol-owned-builders-the-future-of-sovereign-cosmos-mev, 2023
  * [74] James OToole  “Explaining the libor interest rate mess”  In _CNNMoney_ Cable News Network, 2012  URL: https://money.cnn.com/2012/07/03/investing/libor-interest-rate-faq/index.htm
  * [75] Mallesh Pai, Max Resnick and Elijah Fox  “Censorship Resistance in On-Chain Auctions”, 2023  arXiv:2301.13321 [econ.TH]
  * [76] Bob Pisani  “Regulators are worried that retail traders are getting in over their heads” [Online; accessed April-2023]  URL: https://www.cnbc.com/2022/03/28/regulators-are-worried-that-retail-traders-are-getting-in-over-their-heads.html
  * [77] Barry Plunkett  “Skip x Osmosis: Proposal to Capture MEV as Protocol Revenue on Chain” [Online; accessed May-2023], https://gov.osmosis.zone/discussion/7078-skip-x-osmosis-proposal-to-capture-mev-as-protocol-revenue-on-chain, 2021
  * [78] Cow Protocol  “Batch Auctions” [Online; accessed June-2023], https://docs.cow.fi/overview/batch-auctions, 2022
  * [79] Mars Protocol  “Red Bank Architecture” [Online; accessed July-2023], https://docs.marsprotocol.io/docs/learn/red-bank/red-bank-architecture, 2023
  * [80] Penumbra Protocol  “Homomorphic Threshold Encryption” [Online; accessed April-2023], 2023  URL: https://protocol.penumbra.zone/main/crypto/flow-encryption/threshold-encryption.html
  * [81] Kaihua Qin et al.  “An Empirical Study of DeFi Liquidations: Incentives, Risks, and Instabilities”  In _Proceedings of the 21st ACM Internet Measurement Conference_ , IMC ’21  Virtual Event: Association for Computing Machinery, 2021, pp. 336–350  DOI: 10.1145/3487552.3487811
  * [82] Reuters  “Swiss watchdog investigates bank collusion in precious metals market” [Online; accessed April-2023], 2015  URL: https://www.theguardian.com/business/2015/sep/28/swiss-watchdog-investigates-bank-collusion-in-precious-metals-market
  * [83] Torsten Schoeneborn and Alexander Schied  “Liquidation in the Face of Adversity: Stealth vs. Sunshine Trading”, 2009
  * [84] Caspar Schwarz-Schilling et al.  “Time is Money: Strategic Timing Games in Proof-of-Stake Protocols”, 2023  arXiv:2305.09032 [cs.GT]
  * [85] Venkkatesh Sekar  “Preventing front-running attacks using timelock encryption” [Online; accessed April-2023], https://vsekar.me/assets/diss.pdf, 2022
  * [86] Shutter  “Introducing Shutter Network — Combating Front Running and Malicious MEV Using Threshold Cryptography” [Online; accessed April-2023], 2021  URL: https://blog.shutter.network/introducing-shutter-network-combating-frontrunning-and-malicious-mev-using-threshold-cryptography/
  * [87] David Shuttleworth  “Osmosis: A Fully Customizable, Cross-Chain AMM Built on Cosmos” [Online; accessed May-2023], https://consensys.net/blog/cryptoeconomic-research/osmosis-a-fully-customizable-cross-chain-amm-built-on-cosmos/, 2022
  * [88] Sikka  “Projects - Threshold Decryption” [Online; accessed April-2023], https://sikka.tech/projects/, 2019
  * [89] Angeris Guillermo; Kulkarni Kshitij; Chitra Tarun and Diamandis Theo  “The Spectre (and Spectra) of Miner Extracble Value”, 2023  URL: https://angeris.github.io/papers/mev-symmetric.pdf
  * [90] Thomas Thiery  “Empirical Analysis of Builders’ Behavioral Profiles” [Online; accessed Sept-2023], 2023  URL: https://ethresear.ch/t/empirical-analysis-of-builders-behavioral-profiles-bbps/16327
  * [91] Christof Ferreira Torres, Fiona Willi and Shweta Shinde  “Is Your Wallet Snitching On You? An Analysis on the Privacy Implications of Web3”, 2023  arXiv:2306.08170 [cs.CR]
  * [92] Sarisht Wadhwa et al.  “Breaking the Chains of Rationality: Understanding the Limitations to and Obtaining Order Policy Enforcement” https://eprint.iacr.org/2023/868, Cryptology ePrint Archive, Paper 2023/868, 2023  URL: https://eprint.iacr.org/2023/868
  * [93] Anton Wahrstätter et al.  “Blockchain Censorship”, 2023  arXiv:2305.18545 [cs.CR]
  * [94] Eric Wall  “The Case for Social Slashing” [Online; accessed May-2023], https://ercwl.medium.com/the-case-for-social-slashing-59277ff4d9c7, 2022
  * [95] Yoav Weiss  “Unified ERC-4337 mempool”  In _Ethereum.org_ , 2023  URL: https://notes.ethereum.org/@yoav/unified-erc-4337-mempool
  * [96] Yoav Weiss and Vitalik Buterin  “ERC-4337: Account abstraction using Alt Mempool”  In _Ethereum Improvement Proposals_ , 2021  URL: https://eips.ethereum.org/EIPS/eip-4337
  * [97] Wikipedia  “Sybil attack” [Online; accessed May-2023], https://en.wikipedia.org/wiki/Sybil_attack, 2023
  * [98] Carter Woetzel  In _Secret network: A privacy-preserving secret contract & decentralized …_ URL: https://www.securesecrets.org/Secret_Network_Graypaper_2.0.1_1.pdf
  * [99] Anatoly Yakovenko  “Solana: A new architecture for a high performance blockchain”  In _Solana Whitepaper_ URL: https://solana.com/solana-whitepaper.pdf
  * [100] Sen Yang et al.  “SoK: MEV Countermeasures: Theory and Practice”, 2022  arXiv:2212.05111 [cs.CR]
  * [101] Maofan Yin et al.  “HotStuff: BFT Consensus in the Lens of Blockchain”, 2019  arXiv:1803.05069 [cs.DC]
  * [102] Haoxiang Zhu  “Do Dark Pools Harm Price Discovery?”  In _The Review of Financial Studies_ 27.3, 2013, pp. 747–789  DOI: 10.1093/rfs/hht078

##  Appendix A A Case Study: Osmosis

###  A.1 Osmosis Overview

Osmosis is an application-specific automated market maker blockchain
specialized for decentralized exchange transactions rather than arbitrary
state transitions, built on the Cosmos ecosystem [50, 87]. The Osmosis chain
is also home to Mars Protocol [79], a collateralized lending platform.

Over time, the Osmosis community has explored multiple strategies to mitigate
MEV risks, including threshold encryption of pending transactions to prevent
information leakage [69, 4, 70, 72]. Additional techniques have also been
discussed as complements, such as joint block proposals [68, Slide 58],
transaction order randomization, and batch clearing of trades to reduce price
impact [78].

These design choices involve tradeoffs that warrant continued analysis and
debate within the community prior to implementation. This section aims to
highlight some key considerations around the current MEV mitigation agenda on
Osmosis, especially considerations related to the implementation of threshold
encryption on the network.

###  A.2 MEV Classification

To the best of our knowledge, the MEV mitigation agenda is not yet finalized
on Osmosis, but existing proposals give good insights as to how the Osmosis
community plans to handle MEV on the network. According to [5], the current
approach to handle MEV on Osmosis consists of:

  1. 1.

Preventing ’harmful MEV’, which is defined as: at minimum including actions
that are based upon knowledge of ready-to-execute transaction content, prior
to its execution [5]. This includes behaviors like sandwiching, backrunning,
censorship or delaying transactions, and

  2. 2.

Capturing ’benign MEV’ (i.e., MEV that is not ’harmful’) which refers to
extraction based solely on the existing state or public information, such as
arbitrage and liquidation [5]. To do so, the Osmosis community proposes to
capture ’benign MEV’ via in-protocol mechanisms, to redistribute the proceeds
to the community via a governance process.

This direction seems reasonable conceptually. However, developing a robust
methodology to categorize MEV toxicity remains challenging due to the many
subtleties involved. Perspectives on harm can vary significantly between
agents within the network ecosystem. As users can freely move cryptoassets
across blockchains, overly strict limitations deemed detrimental by key
participants like liquidity providers could drive an exodus of capital and
activity to other networks more aligned with their profit motives. Thus, a
balanced perspective accounting for diverse viewpoints will likely be needed,
even if it means tolerating some MEV behaviors deemed harmful by certain
constituencies.

One constructive path forward would be establishing a community-governed
framework to quantify and rate the impact of various activities, using
historical on-chain data to parameterize ’harm’ based on impacts to user
welfare, system overhead, liquidity effects, etc. (e.g., using an open
methodology such as [14]).

Constructing a robust toxicity rating methodology seen as fair and accurate
remains challenging. However, such a data-driven approach could provide a more
objective basis to distinguish acceptable from harmful MEV on an ongoing
basis. We believe engaging the full spectrum of network participants,
especially validators critical to security and operations, will be vital in
devising solutions seen as legitimate.

###  A.3 Slashing

Current proposals suggest using slashing penalties to disincentivize
validators from behaviors such as ’running harmful MEV extraction software’,
’outsourced block production software’, or ’custom transaction ordering
software’ [5]. However, enforcing slashing for the full spectrum of possibly
’harmful’ behaviors faces inherent difficulties:

  * •

Validators can disguise MEV activity across multiple accounts, or Sybils [97],
to evade scrutiny. For instance, a validator may extract MEV via one account
with no value at stake, while maintaining their validation role on another.
Obscuring ’harmful MEV’ activities using Sybils and benefiting from the
information disclosure lag coming from the use of threshold encryption on the
system could be used by malicious actors to, e.g., make it difficult for other
network members to gather enough data to find statistical patterns in
decrypted blocks, in order to avoid or delay detection of malicious validator
behavior.

While social slashing [94] (i.e., slashing by participant vote) may be
possible in extreme cases, it involves a governance process, which may be hard
to coordinate for frequent, harmful MEV-related activity that is hard to
detect and quantify. Especially if not all voters have a technical financial
background.

  * •

Slashing is limited in its ability to disincentivize validators from MEV
extraction. The potential profits likely exceed the cost of slashing penalties
for a profitable attack. Slashing is bounded by the amount staked, whereas
rewards for malicious strategies have no set upper bounds.

  * •

Edge cases inevitably exist that are challenging to classify programmatically
as permissible or malicious beyond doubt. Furthermore, the current definition
of ’harmful MEV’, defined as ’at minimum’ can be seen as ambiguous and hard to
enforce programmatically. For example, does threshold encrypted transaction
spoofing in the Osmosis mempool qualify as ’harmful’ under the current
classification? The answer to this question looks unclear.

Moreover, activities that can be deemed harmful to the network may originate
from any network user, not just validators. Non-validators have no staked
assets at risk of slashing. For instance, a non-validator user may attempt to
manipulate information related to Osmosis trading pools, by e.g., spoofing the
mempool with ’dummy’ encrypted transactions, or by voluntarily disclosing
information about incoming trade intents (see, e.g., LABEL:ssec:privacy-
considerations). Doing so with no ’value at stake’ can allow influential
traders to benefit from the market, without risking being penalized by the
protocol111Repeated examples of market manipulation have been observed from
firms (see LABEL:ssec:collusion) or individuals, e.g., [12], which
demonstrates the limits of ’reputation systems’ to disincentivize such
behavior.

While such behavior may or may not be deemed ’harmful’ under Osmosis’
categorization framework (see A.2), it is possible to foresee scenarios where
behaviors that qualify as ’harmful’ are possible, all while escaping slashing.
Malicious wallet developers, for instance, could sandwich the trades of their
users, allowing sandwiching activity to occur, even if the network uses
threshold encryption. In this case, the wallet software would be able to
access the transaction data before it gets sent on the network (i.e., before
it reaches the mempool) or other information like IP addresses and the user
interface used to generate the transaction [91], and would allow non-validator
wallet developers to carry out ’harmful’ MEV while evading slashing penalties
or causing misattribution of disallowed behaviour to certain validators.

###  A.4 Governance

The Osmosis improvement proposal [5] mentions that Osmosis should implement
in-protocol systems to mitigate harmful MEV while transparently redistributing
profits from non-harmful MEV to the community. Assuming consensus on
classifying benign MEV, a question is how such captured profits should be
redistributed.

The implemented _ProtoRev_ Module Community Proposal [77, 71] added a module
to Osmosis which automatically calculates and executes arbitrage after user
AMM transactions, rebalancing Osmosis liquidity pools. To maintain technical
efficiency, the module does not exhaustively search for all possible
arbitrage, but aims to capture the majority of opportunities. The proceeds of
this arbitrage will form a new type of protocol revenue and will then be
redistributed to the community.

ProtoRev offers interesting tradeoffs, as it makes full use of the
particularities of Osmosis’ bounded MEV domain and application-specific focus
on decentralized exchange 222Implementing a module like ProtoRev to
comprehensively capture benign MEV opportunities for the diverse array of
arbitrary smart contracts on generalized platforms like Ethereum presents a
significantly more complex problem. This stems from the virtually infinite
extraction space created by generic smart contract composability and
Ethereum’s stated goal of remaining neutral between deployed DApps.. This
approach is pragmatic and creates an extra incentive to stake on the system
(which improves the overall security of the network). Importantly, ProtoRev is
compatible with the use of threshold encryption on Osmosis.

However, reliance on governance for redistribution raises concerns around
converting MEV problems into ’governance problems’. In [73], the authors
mention “Governance has full control over block-building and payment
distribution. The chain can vote how MEV is distributed among network
participants, with payments enforced in consensus”. Here, ’the chain’ refers
to its stakeholders.

In particular, influential stakeholders who are able to sway governance
decisions may vote to redirect ’benign MEV’ profits primarily to themselves
rather than the broader community, all while colluding to decrypt the mempool
and benefit from privileged information. This ’privatization’ of on-chain MEV
proceeds could exacerbate centralization forces that MEV mitigation aims to
alleviate. The community should deeply consider solutions like ProtoRev that
address MEV via governance. While pragmatic in the near-term, heavy reliance
on redistribution voting risks recreating similar issues to the MEV challenges
such approaches intend to resolve.

###  A.5 Implementation of Threshold Encrypted Mempools

####  A.5.1 Design Considerations

To the best of our knowledge, Osmosis’ current plans to implement threshold
encryption are best characterized by the Ferveo protocol [13]. Ferveo proposes
efficient distributed key generation and threshold public key encryption
schemes to encrypt and decrypt transactions on BFT consensus blockchains,
aiming to achieve mempool privacy.

The protocol design addresses some, but not all, considerations raised in
LABEL:ssec:privacy-considerations:

  * •

_Message content & DoS:_ The protocol encrypts all transaction contents to all
network participants until finalized in a block, except for public fees. This
prevents spam by ensuring adversaries pay per transaction, and keeps blocks
within gas limits. However, lacking full encryption reveals information and
may enable selective censorship (see, LABEL:ssec:privacy-considerations),
since public fees may indicate transaction intent. Fully encrypting
transactions would likely create extensive ripple effects, necessitating
significant protocol redesign. Given the current network state, these partial
encryption tradeoffs seem inevitable.

  * •

_Optionality:_ Ferveo’s design does not seem to enable optional disclosure of
trade intent. Optionally disclosing (correct or misleading) trade information
remains possible through revelation of plaintext corresponding to ciphertext,
public unenforced claims about trade intents or the use of trusted third
parties attesting to attributes of submitted encrypted transactions (as
discussed in LABEL:ssec:privacy-considerations). However, users lack an avenue
for making credible claims about trading intent without the use of centralized
trusted parties. It remains unclear whether such out-of-protocol disclosure
and actions resulting from this disclosure would qualify as a ’harmful’
endeavor under Osmosis’ MEV classification333By disclosing one’s (genuine or
misleading) trade intentions one can induce market reactions and thus
information streams in the mempool. In such case, inferring information about
the state of the mempool may be possible – despite threshold encryption -,
which may allow extracting value. If the trade intention is honest, an
influential market participant can get the rest of the network to coordinate
to provide him with high levels of liquidity or best execution (e.g., a
’whale’ announcing a large sell on an AMM may induce LPs to provision
liquidity to absorb the trade and minimize price impact, effectively allowing
the ’whale’ to get the ’network to work for them’). If the trade intention is
dishonest (i.e., ’fake news’), the malicious market participant can manipulate
the market, for e.g., get one side of the market to buy (resp. sell) at poor
prices.. We refer readers to LABEL:ssec:privacy-considerations for a more
detailed discussion.

Beyond securely implementing encrypted mempools while preserving efficiency,
using Ferveo may impact validator incentives. Osmosis’ plans empower
validators with more responsibilities (see, e.g., [27]) like generating
decryption keys and decrypting encrypted transactions [13, Section 4]. This
may lead validators to revise their commission structures to account for
additional duties. Such changes could impact overall network incentives.

####  A.5.2 Limitations

LABEL:sec:limits outlines several areas in which the implementation of
threshold encrypted mempools may fall short of desired goals or have
unintended consequences. In order to better understand the implications of
such a scheme for Osmosis, we turn to these areas with the specifics of
Osmosis in mind.

  * •

_Collusion:_ At present, just 7 validators, within the total pool of 150
active validators, cumulatively control over 34% of voting influence [28].
This high centralization raises concerns regarding the potential impacts of
introducing threshold encryption, which invites and is susceptible to
inconspicuous collusion.

  * •

_Ordering & Information Asymmetry:_ Osmosis’ current design, with or without
encrypted mempools, does not limit control over ordering. Similarly, the
impact of information asymmetry and risk of decryption games as described in
LABEL:sec:limits apply directly to Osmosis.

  * •

_Cryptographic Assumptions:_ Ferveo relies on cryptographic assumptions that,
if added to Osmosis, would expand the set of assumptions of the network,
rather than fully align with existing assumptions. In fact, to the best of our
knowledge, the current implementation of Osmosis [26] does not make use of
cryptographic pairings, while Ferveo does. Furthermore, we believe that the
willingness of the authors to use weighted decryption shares to align with the
Tendermint’s security assumptions paves the way for other misalignment, and
collusion.

  * •

_Censorship:_ Although the concerns around broad censorship still apply to
Osmosis, designs like [35] are created with Tendermint chains in mind and
promise improved censorship resistance, albeit still subject to collusion
concerns.

  * •

_Economic Inefficiency & Additional Transactions:_ The main idiosyncrasy of
Osmosis with regard to efficient transaction ordering is ProtoRev. An analysis
of the economic impact of protocol-enforced arbitrage falls outside the scope
of this paper. However, some superficial statements are worth making. Firstly,
ProtoRev’s rebalancing reduces the sensitivity of pool prices to volume
traded, potentially reducing the impact of ordering on execution quality. The
intuition behind this is that without rebalancing, a transaction may trade
against only one pool, moving that price much further than the optimal routing
would have done.

Secondly, due to ProtoRev’s limitations, there is still incentive to
speculatively submit arbitrage transactions. ProtoRev does not rebalance along
all possible routes, nor does it take into account the price of assets on
other domains like CEX’s or other chains. As such, the concerns of blocks
filled with failed transactions highlighted in LABEL:ssec:additionalTx merit
further investigation.

  * •

_Network Size:_ The proposed scheme should not impact the size of the
validator set at the present moment, although the scheme might impact the
feasibility of potential future changes, such as decreased block times or an
expanded validator set.

  * •

_Risk Management and Market Impact:_ As Mars Protocol requires outside actors
to liquidate bad debt and Osmosis is clearly intended as a home for trading,
the considerations in LABEL:ssec:additionalCons apply directly.

###  A.6 Summary

Based on the analysis carried in this paper, we conclude this section by
providing some key suggestions as Osmosis considers implementing threshold
encryption.

First, we encourage refining the classification of MEV on Osmosis. Defining
’harmful’ MEV as ’a minimum’ leaves ambiguity around behaviors not clearly
’harmful’ or ’benign’. Clarifying these definitions would allow deciding on
best measures to mitigate harmful MEV. It would also enable better assessing
if/how threshold encryption aligns with the MEV mitigation agenda.

Second, we strongly encourage carefully evaluating collusion risks. The
difficulty of detecting decryption collusion, coupled with the small number of
influential validators on the network, warrants active discussion of threshold
encryption’s risks and benefits. This is especially important as Osmosis seeks
to empower validators with more duties over time [27]. Over-empowering
validators may raise centralization pressures, incentivizing collusion for
profits at later stages.

Third, when implementing threshold encryption, Byzantine scenarios around
collusion, spoofing, etc. could be modeled on an incentivized testnet to
empirically gather data. Teams of participants could voluntarily collude,
manipulate information flows, and stress test the network in return for OSMO
rewards. Likewise, validators could run specialized software to collect
metrics, and malicious wallets could be implemented to model for some threats
mentioned in this section. With client audits and testnet data, the community
would be better equipped to decide if and how to deploy threshold encryption.

Finally, we encourage further exploration of modifications to the threshold
encrypted mempool design that grant users greater control over the information
which they choose to reveal.

In summary, implementing threshold encrypted mempools necessitates evaluating
impacts on information flows, incentives, and harmful collusion potential. We
believe this research can foster nuanced discussions within and beyond
Osmosis, surfacing both drawbacks and advantages to enrich existing debates.


55: Also at University of Florida, Gainesville, USA
56: Also at Imperial College, London, United Kingdom
57: Also at Moscow Institute of Physics and Technology, Moscow, Russia,
Moscow, Russia
58: Also at P.N. Lebedev Physical Institute, Moscow, Russia
59: Also at California Institute of Technology, Pasadena, USA
60: Also at Budker Institute of Nuclear Physics, Novosibirsk, Russia
61: Also at Faculty of Physics, University of Belgrade, Belgrade, Serbia
62: Also at Trincomalee Campus, Eastern University, Sri Lanka, Nilaveli, Sri
Lanka
63: Also at INFN Sezione di Pavia a, Università di Pavia b, Pavia, Italy
64: Also at National and Kapodistrian University of Athens, Athens, Greece
65: Also at Ecole Polytechnique Fédérale Lausanne, Lausanne, Switzerland
66: Also at Universität Zürich, Zurich, Switzerland
67: Also at Stefan Meyer Institute for Subatomic Physics, Vienna, Austria
68: Also at Laboratoire d’Annecy-le-Vieux de Physique des Particules,
IN2P3-CNRS, Annecy-le-Vieux, France
69: Also at Şırnak University, Sirnak, Turkey
70: Also at Near East University, Research Center of Experimental Health
Science, Nicosia, Turkey
71: Also at Konya Technical University, Konya, Turkey
72: Also at Piri Reis University, Istanbul, Turkey
73: Also at Adiyaman University, Adiyaman, Turkey
74: Also at Ozyegin University, Istanbul, Turkey
75: Also at Necmettin Erbakan University, Konya, Turkey
76: Also at Bozok Universitetesi Rektörlügü, Yozgat, Turkey
77: Also at Marmara University, Istanbul, Turkey
78: Also at Milli Savunma University, Istanbul, Turkey
79: Also at Kafkas University, Kars, Turkey
80: Also at Istanbul Bilgi University, Istanbul, Turkey
81: Also at Hacettepe University, Ankara, Turkey
82: Also at Istanbul University - Cerrahpasa, Faculty of Engineering,
Istanbul, Turkey
83: Also at Vrije Universiteit Brussel, Brussel, Belgium
84: Also at School of Physics and Astronomy, University of Southampton,
Southampton, United Kingdom
85: Also at Rutherford Appleton Laboratory, Didcot, United Kingdom
86: Also at IPPP Durham University, Durham, United Kingdom
87: Also at Monash University, Faculty of Science, Clayton, Australia
88: Also at Università di Torino, TORINO, Italy
89: Also at Bethel University, St. Paul, Minneapolis, USA, St. Paul, USA
90: Also at Karamanoğlu Mehmetbey University, Karaman, Turkey
91: Also at Ain Shams University, Cairo, Egypt
92: Also at Bingol University, Bingol, Turkey
93: Also at Georgian Technical University, Tbilisi, Georgia
94: Also at Sinop University, Sinop, Turkey
95: Also at Erciyes University, KAYSERI, Turkey
96: Also at Institute of Modern Physics and Key Laboratory of Nuclear Physics
and Ion-beam Application (MOE) - Fudan University, Shanghai, China, Shanghai,
China
97: Also at Texas A&M University at Qatar, Doha, Qatar
98: Also at Kyungpook National University, Daegu, Korea, Daegu, Korea