Peal Network The programmable confidentiality layer for digital markets

sealbid

the auctioneer bids blind.

the problem an open book publishes your quantity and your price the moment you bid. the last bidder reads it and only has to beat it by one tick, so bidding early is strictly worse and the sale discovers its price in the final block.

what sealbid does every bid is a commitment onchain. the seller cannot read the quantity or the price inside it, and neither can another bidder. at close the whole book opens at once and settles at one price.

open the live auction see it onchain
open book · todayevery bid readable
bot 0xee…42 450,001 at 1.75, one tick above
450,000at1.70 DUSD
top of book, and everyone can see it
outbid
300,000at2.20 DUSD
readable the moment it lands
260,000at1.20 DUSD
readable the moment it lands
the last bidder reads all of it, and beats it by one tick read, then beaten by 0.05
sealed book commitments only opened together
⬡ 0xca75e985…e0a436
escrow 336,000 quantity ?120,000 price ?2.80 DUSD
⬡ 0x03934b44…921716
escrow 660,000 quantity ?300,000 price ?2.20 DUSD
⬡ 0x6e6c7151…b88828
escrow 765,000 quantity ?450,000 price ?1.70 DUSD
clearing price1.70 DUSDeveryone pays it
nothing to beat by one tick, because there is nothing to read no bid was ever readable before the close

the sniper is not slower. it is blind.

11
transaction to bid. classic commit-reveal needs a second one from the bidder
12
price every winner pays, computed onchain from the revealed book
3 of 53
committee signatures needed before any bid opens

¹ commit only, SealedBidAuction.commitBid · ² uniform clearing price, ClearingPrice.findClearingTick · ³ the demo committee's keys are published on purpose, see honest limits below

the problem

how an open book takes your money

1
450,000at1.70 DUSD
top of book, and everyone can see it
outbid

your bid is legible

exposed

an open order book publishes your quantity and your price the moment you submit. anyone deciding what to bid can read what you already bid.

what you submitted450,000 at 1.70
who can read iteveryone, immediately
2
450,001at1.75 DUSD
top of book, and everyone can see it
outbid

the last block decides

sniped

when the book is readable, the winning move is to wait and submit one tick above the top bid in the final block. bidding early is strictly worse, so nobody does it.

your bid1.70
their bid, one block later1.75
3
300,000at2.20 DUSD
readable the moment it lands

the seller learns your ceiling

shaded

a seller who can read the book learns what each bidder would have paid. knowing that, bidders shade their bids down, and the auction discovers a worse price for everyone.

what you would pay2.20
what you bid instead1.70

the mechanism

how sealbid closes the book

1
⬡ 0xca75e985…e0a436
escrow 336,000 quantity ?120,000 price ?2.80 DUSD

seal, do not disclose

sealed

the bidder encrypts their quantity, their price and a random salt to the committee in their own browser with batched threshold encryption, and posts a commitment to the same values beside the ciphertext hash. nothing readable leaves their machine, and nothing has to be kept: the salt travels inside the ciphertext.

onchaina commitment and a ciphertext hash
quantity and pricenot published
2
765,000 DUSD

escrow is a product, not a price

bounded

the bidder locks quantity times their maximum price. that amount is a visible token transfer, so the size of a bid is public. the split between quantity and price is not.

visiblethe escrow amount
not publishedhow it splits
3
reveal root

one reveal, all at once

t of n

at close the operators each publish a decryption share, and a threshold of them opens the whole batch at once. nobody sends a reveal transaction. the committee then signs one root covering every bid; each revealed bid is checked against the commitment its bidder posted before the close, and the root has to cover the exact number of bids that were committed.

partial revealsrefused
a missing bidhalts settlement
4
clearing tick

one price for everyone

verifiable

demand is bucketed by tick and scanned from the top until it meets supply. everyone above the clearing tick fills in full, everyone at it fills pro rata, and every winner pays the same price.

winners paythe clearing price
allocation orderdoes not matter

use cases

before, and now

five markets that run sealed-bid auctions off-chain, or run the wrong auction onchain because the right one was not available.

onchain name auctions

before

ENS ran a real sealed-bid auction in 2017. it took two transactions, commit and then reveal. bidders who lost their salt or missed the reveal window forfeited their deposit, and the mechanism was retired.

now

the bid is sealed to a committee that opens it at the close, and the reveal is driven against a signed root, not by the bidder coming back. one sealed commit is the bidder’s whole job, and there is no salt to lose.

token launches

before

a fixed-price sale is a gas race that resolves in one block, decided by whoever pays most for priority. a descending auction rewards waiting, so the price you discover is the price of patience.

now

everyone names a maximum privately. everyone who wins pays the same clearing price. submitting early costs nothing and submitting late gains nothing.

nft primary sales

before

an english auction ends in a sniping war, and every visible bid tells the next bidder where the ceiling is. a seller who can read the book can also bid against their own lot.

now

no bid informs another bid. the seller learns the clearing price, and learns it after it has already settled.

tokenized treasuries and private credit

before

allocations are decided by an arranger in a spreadsheet. you submit a size and a yield, you get a fill, and you cannot check that a larger account was not treated better.

now

the allocation rule is a contract. pro rata at the clearing tick, computed onchain from the revealed book, applied identically to every bidder and checkable afterwards.

dao treasury block sales

before

a dao announces a sale in a public forum. the market prices the supply in over three weeks, and the treasury sells into the hole the announcement dug.

now

buyers commit against a fixed size and a fixed window. the market learns the price once, at settlement.

the research

the cryptography is not ours

batched threshold encryption is a construction by the commonware team. we did not invent it, we did not reimplement it, and we do not modify it. peal is what it takes to run it in production.

from commonware
  • the scheme itself, from "a simple batched threshold encryption scheme", guru-vamsi policharla (commonware), iacr eprint 2026/760.
  • every pairing operation, every group fft, and the fujisaki-okamoto transform, in simple-bte, used unmodified as a dependency and pinned to one commit.
  • thresholdization, built into crs::setup. we planned a shamir fallback and did not need it.
what peal adds
  • wire formats with version tags and golden-file tests, so a byte that changes shape fails a test rather than a decryption.
  • payload caps, per-slot validity, and an api shaped for a coordinator, an operator node, and a browser sdk.
  • the rand version is re-exported from one place, so two crates can never disagree about which rng trait they are using.
  • a ceremony, a committee, a batching engine, and reveal plumbing. none of that is cryptography, and all of it is why the cryptography can be used by an application.

one crate touches group elements. every deviation from the upstream api is written down in spec/DEVIATIONS.md with the reason, and every call is mapped function by function in spec/API-MAP.md. where we adapt an api we say so, and we say that it is adaptation rather than a change to the scheme.

what comes next

a faster acknowledgement, without moving the money

bidding today is two transactions on a twelve second chain, and the wait is real even though nothing about the auction depends on it. vara.eth offers a way to shorten the part a person actually feels.

build

an injected transaction answers before the block does. the wallet signs, the write goes straight to vara.eth, and the app gets a promise and a reply it can render immediately. the bidder sees their bid land instead of watching a spinner for a slot.

live

vara.eth settles to ethereum, not to tempo. so this would be something added beside the auction rather than a move, and the contracts stay where they are.

live

escrow stays in solidity. that is gear's own recommended pattern for anything holding value: funds stay in the ethereum contract and a callback confirms release or refund. the auction's money never sits behind a different validator set.

build

an early answer is not finality, and we will label it that way. a promise ahead of settlement is a soft commitment from vara.eth's validators, currently three of four keys operated by one company. showing "committed" on a soft promise, for a transaction carrying escrow, is worse than an honest wait. so a preconfirmed bid will read as preconfirmed until it settles.

honest limits

what this does not do

live

the split is hidden, the size is not. escrow is a token transfer of quantity times max price. prices are a ladder of at most 256 ticks, so anyone who tries can usually narrow the split to a few candidates. this is not bid size privacy and sealbid does not claim it.

live

bids are threshold encrypted, and the bidder keeps nothing. the salt rides inside the ciphertext, so a lost browser no longer costs an allocation. a bid whose ciphertext does not open to what was committed is voided and refunded; it cannot hold up anyone else.

build

the reveal root is signed, not verified onchain. the contract trusts a threshold of committee signatures over the root rather than checking the decryption shares itself. tempo has the pairing precompile and the gas has been measured, so this is scheduled work rather than an open question.

seal now. clear together.

a live auction is open right now, with real escrow and bids sealed to the committee.

open the live auction