PROOF 01
The lock holds
Refused immediately and 4 rounds early. Opens exactly on the round, byte-identical.
$SEALED · sealed-bid batch auctions on Solana
Speed buys nothing.
Orders are timelock-encrypted to a drand round and all open at the same instant. Inside a batch there is no order of arrival, so being first is worth exactly zero.
The mechanism
A lock made of math, not policy.
Nobody has to be trusted not to peek. Nobody can peek — not the dev, not the snipers, not the validator, not us. Keep scrolling and watch the batch.
01
Seal
You encrypt your order toward drand round N, in your own browser. From that moment the ciphertext is unreadable to anyone.
orders 412 · readable 0
02
Window
Orders collect, all unreadable. On-chain you can see how many there are, never what they say. The ring ticks once per drand round.
window open · readable 0 · order of arrival irrelevant
03
Round N
drand publishes the signature for round N. That signature is the key: every order becomes readable at the same instant, to everyone.
readable 412 / 412 · Δt 0 ms
04
Clearing
One uniform price for all. Integer math, pro-rata at the margin. No ordering, no speed advantage, and the sniper gets nothing extra.
clearing price uniform · speed advantage 0
Live, in your browser
Try to open it early.
Seal a bid to a round 60 seconds from now, then try to break it open. Nothing is sent to this server, and the only network call is to the public drand API.
awaiting envelope
Locked until round
—
Proven in code, not claimed
55 checks. Live network. All pass.
Five proofs, each one an attack on the idea, run against the real drand network rather than a mock. Clone it and run them yourself in about two minutes.
0/ 55
checks against the live drand network, all passing
0ms
The sniper arrived first and filled worst: 50,000 of the 600,000 it asked for, at the same price as everyone. It bid low. Speed wasn't a variable.
0→ 1
Three different orders of arrival, one identical clearing hash. The auction doesn't know who came first.
PROOF 02
Speed buys nothing
Three orders of arrival, one identical clearing hash.
PROOF 03
Fraud is catchable
A stranger replays the clearing. 4 planted frauds, all caught. A tampered ciphertext won't open.
PROOF 04
Late bids need anchors
The attack worked. Then anchoring patched it, and the late bid was rejected.
PROOF 05
End to end
A real server, real attacks on the endpoint, an outside witness and 5 forgeries.
$ npm install $ npm run proofs # all 5 proofs, ~2 min ✓ 55 / 55 checks passed
The hole building this revealed
Timelock alone is not enough.
Proofs 1–3 passed, and that nearly fooled us. The fourth test showed that timelock solves only half the problem.
Timelock stops you from reading an order before round N. It doesn't stop you from writing one after it.
- T+0 · ROUND NThe operator waits for the round to open every envelope.
- T+1They read everyone's bid and now know the exact price floor.
- T+2They seal their own bid to a round that has already passed.
- T+3They slip it into the pile. It decrypts perfectly, and the arithmetic still checks out.
The fix · anchoring
The hash of every envelope is anchored on-chain before the round. A ciphertext can never prove when it was made, but an anchor can. Verification rejects anything anchored late, which is why anchoring is a required part of v1.
Honest limits
What this doesn't do.
These belong on the front page, not in a footnote.
L/01
Not a general DEX sandwich fix
Executing a swap needs plaintext. This solves batch auctions and the sniper problem at launch, a narrower claim that's true.
L/02
Verifiable, not yet trustless
Fraud is caught after the fact, not prevented in advance. drand is BLS12-381 and Solana has BN254 syscalls, so on-chain verification isn't trivial today.
L/03
Censorship isn't covered
An operator that silently drops an envelope leaves no trace, unless the sender anchored it themselves.
L/04
Trust assumption
A threshold of League of Entropy nodes must not collude. If they do, they could decrypt early.
L/05
You wait for the window
There's no instant fill. For a trencher chasing the first block that's a change of habit, and it's the real adoption risk.
L/06
No bundling
This is a mechanism against privileged entry. Bundling it would cancel it, and it would be the first thing anyone checks.
The launch that proves itself
$SEALED launches through its own mechanism.
The first launch is the demo. Afterwards the encrypted orders and the drand signature for the round are published, and anyone can decrypt them and check for themselves that the clearing was fair.