# Commit-reveal vs threshold decryption for sealed auctions Commit-reveal keeps bids hidden with nothing but a hash, which is why everyone reaches for it first. Its weakness is that revealing is each bidder’s own move, and a bidder can decide not to make it. ## How commit-reveal works Each bidder publishes a hash of their bid and a secret salt. When bidding closes, each bidder comes back and publishes the bid and the salt, anyone checks them against the hash, and the highest valid reveal wins. No committee, no key, nothing to trust beyond the hash function. For a small auction among people who will reliably return, it is hard to beat. ## The problem: the reveal is a move The flaw is in the second phase. By the time a bidder reveals, they have often seen other reveals. A bidder who now knows they lost, or who placed a bid to probe the market, can simply not reveal. That turns every commitment into a free option: bid, watch, and only show your hand if it pays. It also lets a bidder grief the auction by committing several bids and revealing only the one that hurts a rival most. The standard patch is a penalty. ENS's original registrar, in 2016, ran a 72-hour bidding phase and a 48-hour reveal window; a bid not revealed in time was burned and its ether lost, and an expired sealed bid returned only 0.5% of its deposit. Penalties price the option. They do not remove it, they push honest bidders who simply miss the window into losing money, and they force everyone to come back on time with a second transaction. ## What threshold decryption changes With threshold decryption, a bidder encrypts their bid to a committee's public key and walks away. When the deadline arrives, a threshold of the committee contributes decryption shares and every bid opens at once. Nobody needs to come back. A losing bidder has no move to withhold, because the reveal was never theirs to make. commit-reveal threshold decryption (Peal) can a bidder refuse to reveal? **yes**, at the cost of any penalty **no**: the committee opens every bid does a bidder see others first? often, during the reveal window no: every bid opens in the same instant visits per bidder two: commit, then reveal on time one: seal and leave who could read bids early nobody, if the salt is good a threshold of the committee acting together: 3 of 5 what it relies on a hash function, and bidders coming back the committee's independence and its key generation infrastructure none a committee that is online at the deadline Threshold decryption asks one thing in return: a committee in which fewer than the threshold collude. In exchange, the auction always reveals, every bidder visits once, and nobody gains by disappearing. Peal's key shares are distributed among five operators, run by Peal during testnet, and [v1](https://peal.network/developers/roadmap) generates them with a distributed key generation. ## Other approaches you will hear about - **Shutter Network** uses threshold encryption with keys from a distributed key generation, for transactions on Gnosis Chain, votes on Snapshot and a timed-encryption API. It solves the same withholding problem; see [Peal vs Shutter](https://peal.network/developers/vs-shutter). - **Chainlink Fair Sequencing Services** was proposed in Chainlink's 2021 whitepaper as a way to order transactions fairly, including with threshold encryption. We found no shipped product, so treat it as a design, not an option. - **Timelock puzzles and drand tlock** also remove the reveal move, by tying the opening to computation or to a public beacon's schedule; the [full comparison](https://peal.network/developers/compare) covers both. ## A sealed auction on Peal You open a round with a deadline (`opens_at`, or a block height), each bidder's browser encrypts a bid to the committee and sends only the ciphertext, and when the deadline passes every bid opens together. Every bid is padded to the same size before encryption, so a ciphertext's length says nothing about its amount, and the number of bids stays hidden until the round opens. Positions come from the ciphertext hashes, so nobody chooses where their bid sits. The [auctions guide](https://peal.network/developers/auctions) has the full flow, including uniform clearing prices. ## When commit-reveal is still the right answer When every participant is reliably online, a second transaction is cheap, a missing reveal can be penalised without hurting anyone honest, and you would rather trust a hash function than a committee. Many on-chain games fit that description. Auctions with strangers, agents, or bidders who stand to gain by disappearing usually do not. ## Questions ### What is the difference between commit-reveal and threshold decryption for a sealed-bid NFT auction? In commit-reveal, each bidder must return to reveal, so a losing bidder can decline and the auction depends on penalties. In threshold decryption, bids are encrypted to a committee that opens all of them at the deadline, so there is no reveal step to skip and no bidder sees another's bid first. ### Why do bidders refuse to reveal in commit-reveal auctions? Because by the time they reveal they may already know they have lost, or they bid only to probe the market. Not revealing costs them at most the penalty, so a commitment works like a free option. ### Does threshold decryption need a trusted party? It needs a committee in which fewer than the threshold collude. It does not need any single member to be trusted, provided the members are independent and the key was generated without a dealer. Sources: [ENSIP-2, Initial Hash Registrar (2016)](https://docs.ens.domains/ensip/2/) · [Chainlink 2.0 whitepaper (2021)](https://research.chain.link/whitepaper-v2.pdf) · [Shutter, Applied MEV protection (2025)](https://blog.shutter.network/applied-mev-protection-via-shutters-threshold-encryption/). --- Source: https://peal.network/developers/commit-reveal