Encrypted mempools

1. TL;DR

An encrypted mempool hides a transaction’s contents until its position in a block is fixed, so nobody can frontrun or sandwich it; the two families are threshold cryptography (a committee holds key shares and releases the decryption key after inclusion, as in Shutter) and trusted hardware (transactions are decrypted only inside an attested enclave, as in MEV-SGX, BuilderNet, Unichain’s builder, and Jito’s BAM). Encryption removes network-state MEV (frontrunning, sandwiching, generalized replay) but not block-state MEV (arbitrage, liquidations, backruns), and it adds latency, metadata leakage, and a new trust base: either an honest committee majority or the chip manufacturer. Shutter has been live on Gnosis Chain since July 2024; on Ethereum mainnet and Solana the hardware route is the one in production (as of 2026-08).

2. Explain it simply

Analogy

Sealed-bid auctions work because bids are in envelopes that are opened only after the deadline. An encrypted mempool puts every transaction in an envelope; the block builder must decide the order of the envelopes before anyone, including the builder, can open them. In the threshold version, a jury of key-holders each holds one piece of the letter-opener and they only assemble it once the order is published. In the hardware version, a tamper-proof machine opens the envelopes inside a locked box and only lets the results out.

ELI5

Bots can only attack your trade because they can read it while it waits to be included. An encrypted mempool scrambles your trade so that the people building the block can decide where it goes but not what it is. Only after the order is locked in does a group of key-holders (or a special sealed computer chip) unscramble everything so it can run. Nobody can jump in front of you, because they did not know what you were doing. They can still trade after you once your trade is visible, and if the key-holders or the chip are compromised, the protection is gone.

Step-by-step walkthrough

Alice’s 30,000 USDC swap (the sandwich victim from /mev/mev-taxonomy/) on a Shutter-style chain:

1. Before: the keyper committee has published an eon public key $pk$ for the current epoch; Alice holds 30,000 USDC, the pool holds 1,000 ETH / 3,000,000 USDC.
2. Encrypt: Alice’s wallet encrypts the swap under $pk$ and attaches a signed plaintext envelope: fee payer = Alice, gas consumption = 200,000, gas price = 30 gwei. The searcher watching the network sees only this envelope.
3. Include (block $N$): the proposer includes Alice’s ciphertext in block $N$, collecting 0.006 ETH of fees immediately; the ciphertext is scheduled to execute at the start of block $N+1$, in the order of inclusion. The searcher cannot construct a front-run because it does not know the token, direction, or size.
4. Decrypt: once block $N$ is published, at least $t$ of $n$ keypers release their shares; block $N+1$ must contain the decryption key to be valid.
5. Execute (block $N+1$): Alice’s swap runs first, receiving 9.901 ETH (the no-attack outcome); pool becomes 990.099 ETH / 3,030,000 USDC. A searcher can now include a plaintext backrun later in block $N+1$ to arbitrage the pool against other venues, so backrun MEV survives but Alice’s loss of 0.098 ETH from the sandwich does not occur.

Common misconceptions

• Myth: Encryption eliminates MEV. Reality: it removes attacks that need to see pending transactions (sandwiches, frontruns, replay); arbitrage, liquidations, and backruns on revealed state remain, and so does CEX-DEX MEV.
• Myth: Threshold encryption is trustless. Reality: it assumes fewer than $t$ of $n$ keypers collude (privacy) and at least $t$ are online (liveness); Flashbots’ 2021 review called the honest-committee assumption the main obstacle to making it permissionless.
• Myth: TEEs are “just as good as cryptography”. Reality: Paradigm’s five-level model puts today’s hardware at level 3: great performance and developer experience, but security still rests on proprietary manufacturing and a long history of published breaks.
• Myth: A private RPC is an encrypted mempool. Reality: private RPCs hide transactions from the public but reveal them to the operator and builders; encryption (or an enclave) is what stops the operator itself from seeing them.
• Myth: Solana doesn’t need this because it has no mempool. Reality: Jito’s block engine and private validator mempools recreated visibility; BAM’s answer is to encrypt inside TEEs.

If you only remember one thing

Encrypted mempools fix the order before the contents are known; whether you trust a committee or a chip to keep the contents secret is the entire design question.

3. How it works

Threshold encryption (Shutter)

A set of $n$ keypers, selected from validators, run a distributed key generation (DKG) to produce an eon key; the public part is published for users, and any $t$ keypers can reconstruct the decryption key. Block producers include ciphertext transactions in block $N$ but schedule them for execution at the start of block $N+1$; after block $N$ is produced, keypers publish the decryption key for the transactions scheduled at height $N+1$, and block $N+1$ is invalid without it. Because the execution context (position, block number, timestamp) is fixed before decryption, “it is impossible to use information about the transaction data to extract MEV” (Shutterized Beacon Chain, 2022).

Fees are the subtle part. A block producer cannot know whether a ciphertext can pay, so each ciphertext carries a signed envelope with gas consumption and gas price; the fee $f = g_{\text{consumption}} \times p_{\text{gas}}$ is paid at inclusion, not execution, and the user pays for the full declared gas even if the decrypted transaction uses less. This leaks the fee payer and gas ceiling, from which “a small part of MEV can still be extracted”. Security is parameterized by $(t, n)$: a higher $t$ makes early decryption (collusion) harder but makes liveness more fragile; if keypers go offline the chain can fall back to plaintext-only blocks after $n$ missed slots.

Trusted hardware (MEV-SGX and successors)

Flashbots’ 2021 MEV-SGX design gave both searchers and miners an SGX enclave. The searcher’s enclave validates a full block containing its bundle, encrypts it, and sends it with an unencrypted truncated header hash; the miner’s enclave stores the ciphertext and releases the block only after the miner supplies a proof-of-work solution for that header. This achieves complete privacy (no privileged actor sees the transactions) and permissionlessness (enclaves prevent DoS by validating profitability), the two design goals Flashbots Alpha lacked. The post’s comparison table rates secure enclaves “Yes/Yes/Low–Medium latency” against timelock encryption (privacy correlated with delay, high execution delay), threshold encryption (honest committee, bandwidth expensive), and bonded block headers (high capital cost). Its stated drawback: “the searcher’s privacy guarantees are only as strong as the security of the miner’s enclave”.

Modern versions use VM-level TEEs. Jito’s BAM runs on AMD SEV-SNP (“each TEE instance runs inside its own hardware-isolated virtual machine, with memory encrypted at runtime”, 2–5% overhead, as of 2025-07); clients get a TLS certificate bound to an attestation report, so trust reduces to AMD’s root keys. Unichain’s builder runs on Intel TDX; BuilderNet and Paradigm’s relay-removal design use TEE proofs of validity and bid honesty.

Levels of secure hardware

Paradigm (2024) scores TEEs on performance, developer experience, and security model across five levels: (1) basic oracles and bridges on proprietary supply chains; (2) better developer experience; (3) near-native performance with GPUs, “we are here”; (4) open manufacturing; (5) heterogeneous open hardware for redundancy. Takeaway: “To make things more secure, we’ll need innovation at the hardware layer.”

Threshold encryption to attesters (relay removal)

Paradigm’s 2024 proposal threshold-encrypts a builder’s block to a fraction $t$ of the slot’s attester committee using silent threshold encryption (no DKG; the joint key derives from BLS keys plus published hints). Ciphertexts are 768 bytes larger than plaintext; hints cost ~3 KB per validator (as of 2024-10). This is an encrypted mempool at the block level rather than the transaction level; see /mev/pbs-and-epbs/.

What encryption does and does not remove

Using Qin et al.’s split, encryption eliminates network-state MEV (sandwiches, replay) and leaves block-state MEV (arbitrage, liquidations). In the execution-ticket analysis, encrypted mempools combined with block maximization also blunt multi-slot MEV by forcing the proposer “to decide between leaving all transactions out or including all of them”. Latency is the price: Shutter adds one block; Flashbots noted timelock schemes trade “user experience and security” inversely with delay.

4. Worked numeric example

Same scenario as §2 with concrete parameters.

Envelope fee. Alice declares gas consumption 200,000 and gas price 30 gwei. She pays $200{,}000 \times 30 \times 10^{-9} = 0.006$ ETH at inclusion in block $N$. If the decrypted swap actually uses 150,000 gas, she has overpaid $0.0015$ ETH; this is the cost of not letting the producer see the transaction.

Threshold parameters. Suppose $n = 100$ keypers and $t = 67$. An attacker controlling 30 keypers cannot decrypt early. Liveness holds as long as at most 33 keypers are offline. With $t = 51$ instead, collusion needs only 51 but liveness tolerates 49 offline; the choice is the security–liveness dial the Shutter authors describe.

Sandwich prevented, backrun retained. Without encryption (see /mev/mev-taxonomy/) the attacker earned 299 USDC and Alice lost 0.098 ETH. With encryption Alice receives 9.901 ETH. After her swap executes at the top of block $N+1$, the pool’s price is $3{,}030{,}000 / 990.099 = 3{,}060.3$ USDC/ETH versus 3,000 elsewhere, so ETH is now dearer in this pool. A plaintext backrun later in the same block sells ~4.95 ETH into the pool for $\approx 15{,}075$ USDC against a $\approx 14{,}850$ USDC cost elsewhere, a gross backrun of $\approx 225$ USDC. Encryption alone lets the first plaintext transaction after decryption take it; an orderflow auction could refund it to Alice.

Latency. Alice’s swap is included at block $N$ and executed at block $N+1$: one extra 12 s slot on Ethereum, one 5 s block on Gnosis Chain, one ~400 ms slot on Solana.

5. Where it’s used

Ethereum

• Shutter on Gnosis Chain — first mainnet threshold-encrypted mempool for an Ethereum-like chain, live since 11 July 2024 with Nethermind and Erigon support (Shutter blog, secondary); Ethereum mainnet integration remains a research roadmap.
• BuilderNet — Flashbots, Beaverbuild, and Nethermind’s TEE-based multi-operator block builder (November 2024); Flashbots moved all Protect orderflow and refunds into it in December 2024. Roughly 40% of Ethereum blocks were built in TEEs (as of 2025-07, Helius citing public data, secondary).
• Unichain — TEE (Intel TDX) block builder via Rollup-Boost on mainnet since May 2025; 100% of its blocks are TEE-built (as of 2025-07, Helius); the whitepaper lists an “Encrypted Mempool” as future work on top of the verifiable builder.
• Paradigm relay removal — silent threshold encryption to the attester committee (research, 2024-10).
• Leaderless auctions — threshold-encrypted bids among $3f+1$ participants; see /mev/mev-burn-tickets-focil-timing/.

Solana

• Jito BAM — “an encrypted mempool running inside Trusted Execution Environments (TEEs), where all transactions remain confidential until execution”; BAM nodes on AMD SEV-SNP sequence transactions and sign attestations of the order; launched in a permissioned phase with Helius, SOL Strategies, Triton One, and Figment as early validators and Drift, Pyth, DFlow as plugin partners (as of 2025-07). See /mev/solana-mev/.
• n/a for threshold-encrypted mempools — no Shutter-style keyper committee exists on Solana (as of 2026-08); the 400 ms slot makes a one-block decryption delay comparatively cheap but the leader schedule’s 4-slot windows would let a leader see decrypted transactions across its own slots.

6. Risks, attacks, and incidents

• Secret Network ÆPIC leak (October 2022). Researchers used the xAPIC/ÆPIC Leak SGX vulnerability to extract Secret Network’s consensus seed, the master key that would allow retroactive decryption of every private transaction on the chain; disclosure on 1 October 2022, registration freeze on 4 October 2022 (The Block, Cointelegraph, secondary). Exactly the failure mode Flashbots flagged in 2021: “it would be difficult for the searcher to determine if the miner has broken the enclave.”
• SGX’s track record. Paradigm notes “there is no shortage of vulnerabilities against secure hardware, which have been repeatedly broken by researchers” (2024-11); sgx.fail catalogues them. Helius warns that BAM side-channel breaks “could enable new subtle extraction vectors” and that “BAM does not erase MEV—it relocates it” (2025-07).
• Metadata leakage. Shutter’s envelope reveals fee payer and gas ceiling; timing and size of ciphertexts leak more. The Shutter authors note a zk-SNARK fee proof could close this.
• Liveness failure. If fewer than $t$ keypers are online, blocks with encrypted transactions cannot be built; Shutter’s fallback (fork them out, or revert to plaintext after $n$ empty slots) could reorg “safe” blocks (MicahZoltu, 2022-03).
• Relocated MEV. The backrun survives; MEV moves from sandwichers to whoever controls post-decryption ordering.

7. Open problems

• Committee vs chip. Flashbots (2021) favoured enclaves over threshold committees for permissionlessness; Paradigm (2024) revived threshold encryption by reusing the attester committee; whether Ethereum L1 adopts either is undecided (as of 2026-08).
• Getting to level 4–5 hardware. Paradigm argues real security needs open manufacturing and heterogeneous redundancy; no such hardware exists in production.
• Encrypted mempools and inclusion lists. FOCIL-style lists need committee members to see transactions to list them; the ET post suggests encryption plus block maximization, but the interaction is unspecified.
• Latency budget. One-block delay is acceptable on Gnosis (5 s) and Solana (400 ms) but expensive on Ethereum (12 s); Unichain’s 200 ms flashblocks show TEEs can be fast, but only with hardware trust.
• Does encryption reduce LP losses? It removes sandwiches but not the CEX-DEX arbitrage behind loss-versus-rebalancing; see /exchange/impermanent-loss-vs-lvr/.

8. Ethereum vs Solana

Aspect	Ethereum	Solana
Baseline visibility	public mempool; >50% of gas now private (2025)	no protocol mempool; leaders and Jito see flow
Production encryption	TEE builders (BuilderNet ~40% of blocks, Unichain 100%, 2025-07)	BAM TEE nodes (permissioned rollout, 2025-07)
Threshold scheme	Shutter on Gnosis Chain (since 2024-07); L1 research	none
Decryption delay cost	one 12 s slot (Shutter model)	one ~400 ms slot; leader holds 4 slots
Hardware	Intel TDX (Unichain), SGX/TDX (BuilderNet)	AMD SEV-SNP
Who attests order	TEE proofs; attester committee (proposed)	BAM node signatures + SEV-SNP attestation

Both ecosystems have converged on hardware: the projects that actually ship (BuilderNet, Unichain, BAM) all put ordering inside an enclave and publish attestations, because it is fast and needs no protocol change. Threshold cryptography is the more principled option and is live only where block times are slow enough and the validator set small enough to run a keyper committee (Gnosis). Solana’s advantage is that a decryption delay costs 400 ms rather than 12 s; its disadvantage is that the leader’s four consecutive slots and Jito’s central role mean the enclave must protect against the sequencer operator itself.

9. Reference doc

The reference

Shutterized Beacon Chain — cducrest (Shutter Network; idea credited to Martin Köppelmann, with Justin Drake), 2022-03-24. https://ethresear.ch/t/shutterized-beacon-chain/12249

Summary of the reference

The post’s summary states the thesis: MEV “can be solved directly in an L1 beacon chain” by having a set of nodes generate an encryption key via DKG, letting users encrypt transactions to it, and releasing the decryption key once the encrypted transactions are in the chain. “The problem” cites hundreds of millions of dollars of documented MEV, “worth more than $314M” in 2020 alone, most of it harmful, and singles out frontrunning of DEX traders, bounty claims, auctions, and governance votes.

“Requirements” asks for protection with no user-experience overhead, no weaker security (fallback to unprotected operation if the new assumptions fail), and decentralization comparable to consensus. “Shutter” introduces keypers who run DKG to produce encryption keys and later publish decryption keys, using threshold cryptography so that neither one party nor a colluding minority can decrypt early or halt the system.

“L1 Shutter in core protocol” is the design: keypers are selected among validators (e.g. daily), producing an eon key; block producers include plaintext transactions for execution now and ciphertext transactions scheduled for a future height; after a block is produced, keypers generate the decryption key for the transactions scheduled next, and “the following block must include the decryption key to be considered valid”; the post-state executes the scheduled encrypted transactions first, in inclusion order, before plaintext ones. Because “the execution order and context … is determined by the order of inclusion”, transaction data cannot be used for MEV.

“Ciphertext transaction fees” introduces the signed envelope (gas consumption, gas price, fee-payer signature) paid at inclusion, replacing gas limit with gas consumption so users pay for declared gas up front, and acknowledges the metadata leak and a possible zk-SNARK fix. “Security guarantees” discusses the $t$-of-$n$ trade-off, halting if keypers refuse to publish keys, and two liveness mitigations (allow blocks without keys when no ciphertexts are scheduled; after $n$ slots without a block, drop the key requirement and ignore the ciphertexts). “Changes to the implementation” notes keyper software and encryption logic exist; block validity rules, execution rules, and transaction submission interfaces would need changes. The reply thread debates reorging “safe” blocks and how to detect why a slot was missed.

Key quotes

“The MEV extracted in 2020 alone was worth more than $314M — and that is only a lower bound.” (§The problem)

“The following block must include the decryption key to be considered valid.” (§L1 Shutter in core protocol)

“The context of execution being determined before the decryption of the transaction, it is impossible to use information about the transaction data to extract MEV.” (§L1 Shutter in core protocol)

“The higher t, the harder for keypers to collude and decrypt transactions too early (allowing MEV extraction). On the other hand, a lower t will guarantee that the decryption key is released in a timely manner.” (§Security guarantees)

How to read the original

Background: what a DKG and threshold decryption are, and how beacon-chain block validity is defined. Read “Summary”, “L1 Shutter in core protocol”, and “Ciphertext transaction fees”; skip the implementation section. The hardest paragraph is the fee design: fees must be collected at inclusion because the payer’s balance could change between inclusion and execution, which forces the switch from gas limit to declared gas consumption and creates the metadata leak.

What changed since

• 2022-05: PVDE proposed delay encryption for zk-rollup sequencers as a committee-free alternative.
• 2024-07: Shutterized Gnosis Chain went live (11 July 2024), the first mainnet deployment; Erigon added support in 2025 (secondary).
• 2024-10: Paradigm’s silent-threshold design reused attester keys, avoiding a DKG.
• 2024-11 to 2025: TEE builders (BuilderNet, Unichain, BAM) became the production path on Ethereum L1/L2 and Solana; Ethereum L1 has no scheduled encrypted-mempool EIP (as of 2026-08).

Secondary references

1. “MEV-SGX: A sealed bid MEV auction design” (Flashbots, 2021) — read if you want the hardware alternative and the comparison table of approaches.
2. “The 5 Levels of Secure Hardware” (Paradigm, 2024) — read if you need to decide how much to trust a TEE.
3. “How to Remove the Relay” (Paradigm, 2024) — read if you want threshold encryption without a DKG.
4. “Block Assembly Marketplace (BAM)” (Helius, 2025) — read if you want the Solana TEE mempool in detail.
5. “MEV-resistant ZK-Rollups with Practical VDE” (ethresear.ch/12677, 2022) — read if you want the time-lock route.

The reference

MEV-SGX: A sealed bid MEV auction design — Robert Miller (bertmiller), Flashbots, 2021-05-31. https://ethresear.ch/t/mev-sgx-a-sealed-bid-mev-auction-design/9677

Summary of the reference

After introducing Flashbots’ products (MEV-Geth, MEV-Relay, MEV-Explore) and users (miners, searchers), the post restates the six design goals (permissionless, efficient, pre-trade privacy, failed-trade privacy, complete privacy, finality) and admits Flashbots Alpha is neither permissionless (miners are whitelisted by the relay) nor completely private (miners see bundles), nor final. It explains why the missing two are hard: zero-gas-price bundles create a DoS vector because miners must simulate them; a permissionless relay would need spam protection; and full privacy requires miners to include what they cannot see. It then surveys alternatives (timelock encryption, threshold encryption, secure enclaves, block headers, bonded block headers) in a table of permissionlessness, privacy, latency, and drawbacks, and proposes MEV-SGX: searchers validate and encrypt full blocks in their enclave and send ciphertext plus a truncated header hash; miners mine on the hash and can decrypt, seal, and propagate only after finding a valid proof-of-work solution. The design achieves complete privacy and permissionlessness at the cost of enclave trust and possible latency.

Key quotes

“It is not permissionless because miners who adopt it have to be whitelisted by MEV-Relay in order to be forwarded bundles.” (§MEV-Geth and Flashbots’ design goals)

“A drawback of this solution is that the searcher’s privacy guarantees are only as strong as the security of the miner’s enclave” (§Secure enclaves)

“Only after finding a proof-of-work solution and providing that to their SGX can miners decrypt the encrypted block, seal it, and propagate it to the network.” (§MEV-SGX)

How to read the original

Background: MEV-Geth bundles and proof-of-work sealing. Read the design-goals section and the comparison table first. The hardest part is why the truncated header hash suffices: the miner can perform work on a header commitment without knowing the body, so privacy holds until the block is already won.

What changed since

• 2022-09: The Merge removed proof-of-work; the “seal on PoW” trick no longer applies, and MEV-Boost relays took the escrow role instead.
• 2022-10: The ÆPIC leak against Secret Network showed enclave-key extraction in practice.
• 2024-11: BuilderNet shipped TEE block building; 2025: Unichain and BAM extended it to L2 and Solana.

Secondary references

1. “The 5 Levels of Secure Hardware” (Paradigm, 2024) — read for the security-model taxonomy.
2. “Secret Network says it resolved risk from Intel hardware vulnerability” (The Block, 2022) — read for the incident.
3. “Introducing BuilderNet” (Flashbots, 2024) — read for the production successor.

10. Sources

• Shutterized Beacon Chain — cducrest (Shutter) — 2022-03-24 — https://ethresear.ch/t/shutterized-beacon-chain/12249
• MEV-SGX: A sealed bid MEV auction design — Robert Miller (Flashbots) — 2021-05-31 — https://ethresear.ch/t/mev-sgx-a-sealed-bid-mev-auction-design/9677
• The 5 Levels of Secure Hardware — Paradigm (Georgios Konstantopoulos) — 2024-11-21 — https://www.paradigm.xyz/writing/the-5-levels-of-secure-hardware
• How to Remove the Relay — Paradigm — 2024-10-08 — https://www.paradigm.xyz/writing/removing-the-relays
• Leaderless Auctions — Paradigm — 2024-02-13 — https://www.paradigm.xyz/writing/leaderless-auctions
• Block Assembly Marketplace (BAM) — Helius — 2025-07 — https://www.helius.dev/blog/block-assembly-marketplace-bam
• Execution Tickets — Justin Drake, Mike Neuder — 2023-12-23 — https://ethresear.ch/t/execution-tickets/17944
• MEV-resistant ZK-Rollups with Practical VDE (PVDE) — ethresear.ch — 2022-05-20 — https://ethresear.ch/t/mev-resistant-zk-rollups-with-practical-vde-pvde/12677
• Quantifying Blockchain Extractable Value — Qin, Zhou, Gervais — 2021-01-14 — https://arxiv.org/abs/2101.05511
• Quantifying the Threat of Sandwiching MEV on Jito — Gerzon et al. (ACM IMC ‘25) — 2025-10 — https://doi.org/10.1145/3730567.3764493
• Unichain whitepaper — Adams et al. — 2024-10 — https://developers.uniswap.org/whitepaper_unichain.pdf
• The First L2 TEE Block Builder is Live on Unichain Mainnet — Flashbots — 2025-05-02 — https://writings.flashbots.net/unichain-mainnet
• Shutterized Gnosis Chain is Live — Gnosis (secondary) — 2024-07 — https://www.gnosis.io/blog/shutterized-gnosis-chain-is-live
• Erigon Now Supports Shutter’s Encrypted Mempool on Gnosis Chain — Shutter Network (secondary) — 2025 — https://blog.shutter.network/erigon-now-supports-shutters-encrypted-mempool-on-gnosis-chain/
• Secret Network says it resolved risk from Intel hardware vulnerability — The Block (secondary) — 2022-11 — https://www.theblock.co/post/190914/secret-network-says-it-resolved-risk-from-intel-hardware-vulnerability
• 2 Million Protect Users — Flashbots — 2025 — https://writings.flashbots.net/2m-protect-users