the mempool goes dark.
transactions travel as 48-byte sealed capsules. builders order what they cannot read. when the block is final, the whole batch opens at once, and the sandwich never had anything to see.
the searcher's problem is not made harder. it is made empty.
¹ Shutter / Primev, 2025 (cumulative since 2020) · ² Flashbots Protect + MEV Blocker protected volume · ³ Shutter on Gnosis, Oct 2025
how the public mempool takes your money
the same swap in a normal, readable mempool. three moves, and the searcher wins.
your order is public
exposedon a normal chain your swap waits in the public mempool in plain sight. anyone watching, including automated searchers, can read the amount, the direction, and the price you are willing to accept, all before it executes.
the searcher jumps ahead
front-runseeing your trade coming, the searcher places its own buy just ahead of yours. that pushes the pool price up, so your swap is now lined up to fill at a worse rate than you were quoted.
you fill worse, it takes the spread
sandwichedyour swap executes at the price the searcher left behind, and the searcher immediately sells back into it. you receive less than your quote, and that difference, sized to your own slippage limit, is what the sandwich costs you.
how peal keeps your order private
four steps, and every value below is a real artifact from your swap, verifiable on-chain.
encrypted on your device
privateyour order is encrypted on your own device before it reaches the network. the amount, the direction, and the token stay sealed inside a ciphertext addressed to the committee's key. no relayer, no node, and no operator ever sees it in the clear.
hidden inside a batch
unlinkablethe ciphertext drops into a fixed batch of 64 slots. the other slots are indistinguishable decoys, so no observer can tell how many real orders are inside, or which slot is yours. your size, your timing, and your intent disappear into the crowd.
sealed to a distributed committee
t-of-nthe power to open your batch is split across a committee of independent operators, none of them trusted. any 3 of the 5 can open it together, and only once the cue fires. no single operator, and no group smaller than the quorum, can read your order early.
revealed and proven on-chain
verifiableat the cue, a quorum of operators each return one 48-byte share. together they open the whole batch at once, after the ordering is already fixed, so there is nothing left to front-run. every share is checked with a public pairing equation, and the settlement contract re-derives the batch's merkle root and rejects any mismatch.
why batched
the moat is one 48-byte value
| per-transaction threshold | per-epoch threshold | batched threshold (peal) | |
|---|---|---|---|
| committee traffic | one share per tx · O(n·B) | one key per epoch | one 48-byte value per operator · O(n) |
| unincluded txs | stay private | exposed at epoch key drop | stay private |
| slot/epoch binding | none | required | none |
| reveal latency | grows with load | epoch-bound | ~1s finalize · precompute hidden |
"the shutter team anticipates that batched threshold encryption (BTE) is a potential way to address the drawbacks of both per-epoch and per-transaction schemes."
shutter, who run today's live threshold mempool on a per-epoch design, oct 2025
seal now. reveal on cue.