Selling Privacy in Blockchain Transactions
Pith reviewed 2026-05-21 16:55 UTC · model grok-4.3
The pith
Privacy-aware blockchain users sell transaction execution rights via an optimal sealed-bid auction or a posted-price mechanism that approximates optimal social welfare.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
Incorporating a negative dependence of utility on preference exposure allows the authors to characterize the optimal auction for selling transaction execution rights as a sealed-bid format and to design a posted-price mechanism for the two-sided privacy marketplace that guarantees a constant approximation to the optimal social welfare while preserving incentive compatibility from both market sides and budget balance.
What carries the argument
The privacy-dependent utility model in which a user's payoff decreases with the degree of exposure of her economic preferences, which shapes both the single-sided auction characterization and the two-sided posted-price design.
If this is right
- Auction revenue and the user's net utility vary directly with the degree of privacy maintained in the order flow sale.
- The revenue of the gradual Dutch auction approaches that of the optimal sealed-bid auction as the number of communication rounds increases.
- The posted-price mechanism in the two-sided market remains incentive compatible for both users and searchers while exactly balancing the budget.
- The mechanism delivers a constant-factor guarantee on social welfare relative to the optimal benchmark in the privacy marketplace.
Where Pith is reading between the lines
- These designs could reduce front-running risks in decentralized finance by limiting how much preference information leaks to potential adversaries.
- The same privacy-marketplace structure might extend to other preference-hiding settings such as matching markets or procurement auctions where participants also dislike revealing their valuations.
- Deployment on blockchain testnets could measure whether real users' willingness to sell execution rights matches the modeled privacy-utility trade-off.
Load-bearing premise
That transaction owners' utility decreases in a quantifiable way when their economic preferences are exposed to others.
What would settle it
An empirical test or simulation in which participants' actual bids, participation rates, or reported utilities in the proposed auctions and marketplace show no reduction or even an increase when preference exposure rises would falsify the welfare and revenue results.
read the original abstract
We study methods to enhance statistical privacy in blockchain transactions. We analyze economic mechanisms for privacy-aware transaction owners whose utility depends not only on the outcome of the mechanism but also negatively on the exposure of their economic preferences. First, we consider an order flow auction, where a user auctions off to specialized agents, called searchers, the right to execute her transaction while maintaining a degree of privacy. We examine how the degree of privacy affects the revenue of the auction and, broadly, the net utility of the privacy-aware user. In this new setting, we characterize the optimal auction, which is a sealed-bid auction. Subsequently, we analyze a variant of a Dutch auction in which the user gradually decreases the price and the degree of privacy until the transaction is sold. We compare the revenue of this auction to that of the optimal one as a function of the number of communication rounds. Then, we introduce a two-sided market - a privacy marketplace - with multiple users selling their transactions under their privacy preferences to multiple searchers. We propose a posted-price mechanism for the two-sided market that guarantees constant approximation of the optimal social welfare while maintaining incentive compatibility (from both sides of the market) and budget balance. This work builds on the emerging literature on privacy-preserving mechanism design, integrating statistical privacy guarantees into economic protocols to capture the impact of information leakage on blockchain users' utility.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper studies economic mechanisms to enhance statistical privacy in blockchain transactions for privacy-aware users whose utility depends on the mechanism outcome and negatively on exposure of their economic preferences. It first analyzes a single-sided order flow auction between a user and searchers, characterizing the optimal mechanism as a sealed-bid auction and comparing its revenue to a multi-round Dutch auction variant as a function of communication rounds. It then considers a two-sided privacy marketplace with multiple users and searchers, proposing a posted-price mechanism that achieves constant-factor approximation to optimal social welfare while satisfying incentive compatibility on both sides and budget balance.
Significance. If the utility model and derivations hold, the work contributes to privacy-preserving mechanism design by integrating statistical privacy considerations into auction theory for blockchain settings. The sealed-bid characterization and constant-approximation posted-price mechanism with IC and budget balance could guide practical protocol design. The paper builds on prior mechanism design literature but would benefit from explicit verification of the privacy-dependent utility to support its claims.
major comments (3)
- [Model Definition] Model section (near abstract and introduction): The utility function for privacy-aware transaction owners is defined to depend negatively on exposure of economic preferences, yet no explicit functional form (e.g., additive penalty linear in exposure level, multiplicative factor, or tied to a concrete statistical privacy metric such as differential privacy parameter) is provided. This form is load-bearing for the optimal auction characterization, revenue comparisons, and the constant welfare approximation guarantee; without it the derivations cannot be verified or reproduced.
- [Order Flow Auction] Order flow auction section: The claim that the optimal auction is a sealed-bid auction is stated without a derivation, proof sketch, or explicit virtual-value adjustment accounting for the privacy exposure term. This undermines the revenue analysis and comparison to the Dutch auction variant across communication rounds.
- [Two-Sided Privacy Marketplace] Two-sided market section: The posted-price mechanism is asserted to guarantee constant approximation of optimal social welfare while maintaining two-sided IC and budget balance, but the specific constant, the welfare benchmark, and the proof of the approximation ratio are not detailed enough to assess whether the privacy-dependent utilities preserve the guarantees.
minor comments (2)
- [Abstract] Abstract: The phrase 'constant approximation' is used without naming the ratio or the approximation target (e.g., optimal welfare), reducing clarity for readers.
- [Throughout] Notation: The distinction between 'degree of privacy' and 'exposure of economic preferences' should be formalized with consistent symbols to avoid ambiguity in the utility definition.
Simulated Author's Rebuttal
We thank the referee for the constructive feedback. The comments highlight opportunities to improve clarity and completeness in the model definition, auction characterizations, and mechanism analysis. We address each point below and will incorporate revisions to strengthen verifiability without altering the core contributions.
read point-by-point responses
-
Referee: [Model Definition] Model section (near abstract and introduction): The utility function for privacy-aware transaction owners is defined to depend negatively on exposure of economic preferences, yet no explicit functional form (e.g., additive penalty linear in exposure level, multiplicative factor, or tied to a concrete statistical privacy metric such as differential privacy parameter) is provided. This form is load-bearing for the optimal auction characterization, revenue comparisons, and the constant welfare approximation guarantee; without it the derivations cannot be verified or reproduced.
Authors: We agree that an explicit functional form strengthens verifiability. The manuscript implicitly uses a linear penalty on exposure (utility = transaction value - payment - lambda * exposure, with exposure quantified via a statistical leakage metric), but this was not stated formally in the Model section. In revision we will add the precise definition, including how the privacy term integrates into virtual valuations and welfare calculations. revision: yes
-
Referee: [Order Flow Auction] Order flow auction section: The claim that the optimal auction is a sealed-bid auction is stated without a derivation, proof sketch, or explicit virtual-value adjustment accounting for the privacy exposure term. This undermines the revenue analysis and comparison to the Dutch auction variant across communication rounds.
Authors: The sealed-bid optimality follows from a direct adaptation of Myerson's framework where the privacy exposure enters as an additive cost in the bidder's utility, shifting the virtual value by the marginal privacy cost. We will insert a concise proof sketch in the revised Order Flow Auction section that derives the optimal mechanism and explains the revenue comparison to the multi-round Dutch variant as a function of communication rounds. revision: yes
-
Referee: [Two-Sided Privacy Marketplace] Two-sided market section: The posted-price mechanism is asserted to guarantee constant approximation of optimal social welfare while maintaining two-sided IC and budget balance, but the specific constant, the welfare benchmark, and the proof of the approximation ratio are not detailed enough to assess whether the privacy-dependent utilities preserve the guarantees.
Authors: The mechanism achieves a 2-approximation to the optimal social welfare benchmark (maximum welfare under privacy-adjusted valuations). We will expand the section with the explicit constant, a clear definition of the benchmark, and a high-level proof outline showing that the posted prices preserve two-sided IC and budget balance even after incorporating the privacy terms into reported valuations. revision: yes
Circularity Check
No significant circularity; derivations follow from standard mechanism design on defined utility model
full rationale
The paper defines a privacy-dependent utility function at the outset (negative dependence on exposure of economic preferences) and applies standard auction theory to characterize a sealed-bid optimal auction and a posted-price two-sided mechanism with constant welfare approximation. No derivation step reduces by construction to its own inputs, fitted parameters, or self-citation chains. The results are self-contained applications of existing mechanism design tools to the new setting, with external grounding in prior privacy-preserving mechanism design literature. The lack of an explicit functional form for the utility penalty is a modeling choice affecting applicability, not a circularity issue.
Axiom & Free-Parameter Ledger
axioms (1)
- domain assumption Transaction owners have utility that decreases with exposure of their economic preferences
invented entities (1)
-
Privacy marketplace
no independent evidence
Lean theorems connected to this paper
-
IndisputableMonolith/Cost/FunctionalEquation.leanwashburn_uniqueness_aczel unclear?
unclearRelation between the paper passage and the cited Recognition theorem.
utility depends not only on the outcome of the mechanism but also negatively on the exposure of their economic preferences... privacy cost c:[0,1]→R≥0 convex non-decreasing
-
IndisputableMonolith/Foundation/ArithmeticFromLogic.leanembed_strictMono_of_one_lt unclear?
unclearRelation between the paper passage and the cited Recognition theorem.
privacy-enhanced virtual value ˜ϕk(v)=v−(1−Fk(v))/fk(v)−ck
What do these tags mean?
- matches
- The paper's claim is directly supported by a theorem in the formal canon.
- supports
- The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
- extends
- The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
- uses
- The paper appears to rely on the theorem as machinery.
- contradicts
- The paper's claim conflicts with a theorem or certificate in the canon.
- unclear
- Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.
Reference graph
Works this paper leans on
-
[1]
[AHN+19] Saeed Alaei, Jason Hartline, Rad Niazadeh, Emmanouil Pountourakis, and Yang Yuan
[Online; accessed December-2024]. [AHN+19] Saeed Alaei, Jason Hartline, Rad Niazadeh, Emmanouil Pountourakis, and Yang Yuan. Optimal auctions vs. anonymous pricing.Games and Economic Behavior, 118:494–510,
work page 2024
-
[2]
SoK: Privacy-preserving transactions in blockchains
[BCMR24] Foteini Baldimtsi, Kostas Kryptos Chalkias, Varun Madathil, and Arnab Roy. SoK: Privacy-preserving transactions in blockchains. Cryptology ePrint Archive, Paper 2024/1959,
work page 2024
-
[3]
Transaction Fee Mechanism Design in a Post-MEV World
[BGR24] Maryam Bahrani, Pranav Garimidi, and Tim Roughgarden. Transaction Fee Mechanism Design in a Post-MEV World. In Rainer B¨ ohme and Lucianna Kiffer, editors,6th Conference on Advances in Financial Technologies (AFT 2024), volume 316 ofLeibniz International Proceedings in Informatics (LIPIcs), pages 29:1–29:24, Dagstuhl, Germany,
work page 2024
-
[4]
Designing Multidimensional Blockchain Fee Markets
[DECA23] Theo Diamandis, Alex Evans, Tarun Chitra, and Guillermo Angeris. Designing Multidimensional Blockchain Fee Markets. In Joseph Bonneau and S. Matthew Weinberg, editors,5th Conference on Advances in Financial Technologies (AFT 2023), volume 282 ofLeibniz International Proceedings in Informatics (LIPIcs), pages 4:1–4:23, Dagstuhl, Germany,
work page 2023
-
[5]
[DRea14] Cynthia Dwork, Aaron Roth, and et al
[Online; accessed May-2025]. [DRea14] Cynthia Dwork, Aaron Roth, and et al. The algorithmic foundations of dif- ferential privacy.Foundations and Trends®in Theoretical Computer Science, 9(3-4):211–407,
work page 2025
-
[6]
[GR23] Mohak Goyal and Geoffrey Ramseyer
Association for Computing Machinery. [GR23] Mohak Goyal and Geoffrey Ramseyer. Pricing personalized preferences for privacy protection in constant function market makers. InProceedings of the 2023 Workshop on Decentralized Finance and Security, DeFi ’23, page 41–48, New York, NY, USA,
work page 2023
-
[7]
[Online; accessed December-2024]. [Mil23] Robert Miller. MEV-Share: Programmably Private Orderflow to Share MEV with Users, February
work page 2024
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.