Skip to content
DeFi Reference

PBS and ePBS

1. TL;DR

Section titled “1. TL;DR”

Proposer-builder separation (PBS) lets a validator sell the right to fill its block to specialized builders who compete in an auction, so home stakers earn MEV without running trading infrastructure. Today this runs out of protocol through MEV-Boost, where a handful of trusted relays escrow blocks between builders and proposers; that trust failed publicly in April 2023 when a proposer exploited a relay bug to unbundle about $20M of searcher transactions. Enshrined PBS (ePBS, EIP-7732) moves the builder commitment and payment into consensus, and Paradigm’s relay-removal design uses threshold encryption to the attester committee so builders can talk to proposers directly.

2. Explain it simply

Section titled “2. Explain it simply”

Analogy

Section titled “Analogy”

A landlord (the validator) owns a shop window for twelve seconds. Rather than arranging the display themselves, they let professional window-dressers (builders) bid for the slot. The dressers won’t show the landlord their arrangement before winning, because the landlord could copy it, so an escrow agent (the relay) holds the sealed display, tells the landlord only the bid amounts, and reveals the display once the landlord has signed a contract to use it. Enshrined PBS writes that escrow into the lease itself so no agent is needed.

ELI5

Section titled “ELI5”

Every twelve seconds one validator gets to publish a block. Building the most valuable block is hard, so the validator lets specialist builders compete: each builder offers “I’ll pay you X if you publish my block.” The validator picks the biggest X without seeing what is inside, signs it, and only then gets the contents. A middleman called a relay keeps the contents secret and checks the builder actually pays. The problem is that the middleman must be trusted by everyone, and only a few of them exist. Enshrined proposer-builder separation puts the middleman’s job into the blockchain rules so no middleman is needed.

Step-by-step walkthrough

Section titled “Step-by-step walkthrough”

One MEV-Boost slot, with two builders:

  1. Before (t = −2 s): the slot-N proposer holds 32 ETH of stake and no block. Builder A holds 0.30 ETH of gross block value (0.25 ETH coinbase transfers from searcher bundles + 0.05 ETH priority fees); Builder B holds 0.28 ETH.
  2. Bidding (t = −2 s to 0): A and B send full blocks to relays. The relay simulates each block, confirms validity, and records the payment to the proposer: A bids 0.281 ETH, B bids 0.279 ETH (each shading down from full value to keep a margin).
  3. Header selection (t ≈ 0): the proposer’s MEV-Boost sidecar calls getHeader on every connected relay and receives blinded headers with values 0.281 and 0.279. It signs A’s header.
  4. Reveal (t ≈ 0.1 s): the relay receives the signed header, publishes A’s full block to the network, and returns it to the proposer.
  5. After: the proposer’s balance is +0.281 ETH (paid inside the block); Builder A nets 0.30 − 0.281 = 0.019 ETH; the searchers’ bundles executed in A’s order; B’s block is discarded and B pays nothing.

Common misconceptions

Section titled “Common misconceptions”
  • Myth: MEV-Boost is part of Ethereum’s protocol. Reality: it is a sidecar maintained by Flashbots and relay operators; consensus clients only know the builder API. ePBS (EIP-7732) is the proposal to enshrine it.
  • Myth: The proposer can inspect the block before signing. Reality: the proposer sees only a blinded header and a bid; that is precisely why a relay is trusted to reveal the body afterwards.
  • Myth: Relays are neutral utilities with no power. Reality: relays can censor (several filtered OFAC-sanctioned addresses post-Merge), add latency, and were the single point of failure in the April 2023 exploit.
  • Myth: ePBS removes builders’ dominance. Reality: it removes the relay trust assumption; builder concentration (three builders producing about 90% of blocks, as of 2025-07) is a separate problem addressed by inclusion lists and orderflow reforms.
  • Myth: Solana has PBS too. Reality: the leader still builds and executes; Jito’s block engine only auctions partial-block bundles, though BAM (2025) moves Solana toward a PBS-like split.

If you only remember one thing

Section titled “If you only remember one thing”

PBS separates who signs the block from who fills it; the whole design problem is delivering builder privacy and proposer payment safety without a trusted relay in between.

3. How it works

Section titled “3. How it works”
Ethereum MEV supply chain under MEV-Boost: users, searchers, builders, relays, proposers Users / walletstxs → mempool / OFASearchersbundles + bidsBuildersfull blocks + bidRelaysescrow, validateProposersigns highest header value flows right → left as bids; ordering rights flow left → right. Solana replaces builders/relays with the leader's scheduler + Jito block engine.
The MEV-Boost pipeline. Builders assemble full blocks from user and searcher flow, relays escrow them, and the proposer signs the most valuable blinded header.

The MEV-Boost protocol

Section titled “The MEV-Boost protocol”

Flashbots’ 2021 architecture defines five roles: users, searchers, builders, relays, and proposers, with a sidecar (mev-boost) between the consensus and execution clients. Per slot: builders construct execution payloads and submit them to relays; relays verify validity and compute the payment to the proposer’s feeRecipient; the proposer requests headers (getHeader), signs the most valuable, and returns it (getPayload); the relay publishes the block. Relay-imposed cutoffs require getHeader by t=3t=3 s and getPayload by t=4t=4 s into the slot (as of 2023-12). The relay’s two guarantees are privacy for builders (the proposer cannot see and steal bundles) and safety for proposers (the block is valid and the bid is real).

Adoption: ≈90% of blocks (as of 2023-05), 91.8% (as of 2023-12). For a validator, the median block reward rises from 0.0076 ETH (local) to 0.0380 ETH (MEV-Boost), lifting annual revenue from 0.929 to 1.009 ETH and APR from 2.93% to 3.24% (Nov 2023–Jun 2024 data, as of 2024-06).

The auction

Section titled “The auction”

The MEV-Boost auction is an open ascending first-price auction: builders see the current top bid on the relay and re-bid until the proposer calls getHeader, so the winning bid b∗≈v(2)+εb^{*} \approx v_{(2)} + \varepsilon where v(2)v_{(2)} is the second-highest builder valuation. More than 88% of auctions were competitive and top-three builders earn margins of 1–5.4% (as cited in Stichler, as of 2024-08). Because block value rises within the slot, proposers are tempted to delay getHeader (see /mev/mev-burn-tickets-focil-timing/).

Why enshrine

Section titled “Why enshrine”

Neuder and Drake (2023) make three arguments. Relays oppose Ethereum’s values: six relays run by five entities delivered 99% of MEV-Boost blocks (as of 2023-05); relays can censor; both sides must trust them. Out-of-protocol software is brittle: the “Low-Carb Crusader” unbundling took 20+ million USD and the patches that followed caused a 5× spike in reorged blocks. Relays are unfunded public goods costing $20k–100k per year each (as of 2023-05). They list six properties for ePBS: honest builder publication safety, builder payment safety, proposer safety, permissionlessness, censorship resistance, and roadmap compatibility.

Two-slot ePBS

Section titled “Two-slot ePBS”

Buterin’s 2021 design: builders publish signed exec headers (hash + bid) before t=0t=0; the beacon block at t=0t=0 includes the winning header and one committee attests; at t=8t=8 s the builder publishes the intermediate block with the execution body and the remaining N−1N-1 committees attest. Payment is an in-protocol balance transfer (val.balance -= bid_amount), unconditional once the beacon block is canonical. Later designs (Payload-Timeliness Committee, 2023; Minimal ePBS, 2024) keep a single 12 s slot with a small timeliness committee; this lineage became EIP-7732.

Removing the relay with threshold encryption

Section titled “Removing the relay with threshold encryption”

Paradigm’s 2024 proposal keeps the MEV-Boost market but deletes the relay. The builder threshold-encrypts its block to a fraction tt of the slot’s attester committee using silent threshold encryption (no interactive key generation; the joint key is derived from validators’ existing BLS keys plus published “hints”), attaches a TEE proof that the bid is honest and the block valid, and sends header plus ciphertext directly to the proposer. Once tt attesters have attested to the signed header, their attestations form the decryption key. Ciphertexts are only 768 bytes larger than plaintext; each validator must publish about 3 KB of hints, which is roughly 3 GB for ~1 million validators (as of 2024-10), expected to shrink after MaxEB consolidation. Relays add 5–20 ms of processing latency (as of 2024-10), so a single-hop design should also raise proposer revenue.

Equivocation and headlock

Section titled “Equivocation and headlock”

A malicious proposer can double-sign headers to split attesters and force the builder to reveal a payload that is then reorged and unbundled. D’Amato and Neuder show the attacker needs at least 30% attestation weight on the competing block given the 40% proposer boost, and propose headlock (attesters ignore blocks from an equivocating proposer) for both MEV-Boost and two-slot ePBS.

4. Worked numeric example

Section titled “4. Worked numeric example”

Continue the §2 scenario. Builder A’s block contains searcher bundles worth 0.25 ETH in coinbase transfers plus 0.05 ETH of priority fees, so vA=0.30v_A = 0.30 ETH; vB=0.28v_B = 0.28 ETH.

Ascending auction. Both builders watch the relay’s top bid and raise until only one can profitably continue. B stops at 0.280.28; A wins with b∗=0.28+ε≈0.281b^{*} = 0.28 + \varepsilon \approx 0.281 ETH. Builder A’s profit =vA−b∗=0.019= v_A - b^{*} = 0.019 ETH (6.3% margin, within the 1–5.4% range observed for top builders when competition is tighter).

Proposer economics. The proposer earns 0.281 ETH. A validator proposes ~2.6 blocks per year, so the median MEV-Boost block (0.038 ETH) yields ~0.0998 ETH/year versus 0.0199 ETH locally built (as of 2024-06); this slot is a heavy-tail outlier.

Timing pressure. Suppose block value grows at 0.004 ETH per second during the slot. Delaying getHeader by 2 s raises the bid to ≈0.289 ETH (+0.008), but past the t=3t=3 s relay cutoff the proposer gets nothing, and past t=4t=4 s the block is likely reorged under honest-reorg rules. The rational proposer stops at about t=2t=2–33 s.

Relay-free variant. Under the threshold-encryption design, Builder A instead encrypts its block (+768 bytes) to t=2/3t = 2/3 of a 512-validator committee and attaches a TEE proof; the proposer still signs the highest of (0.281, 0.279) but no relay sees either block, and the body decrypts once 342 attestations arrive.

5. Where it’s used

Section titled “5. Where it’s used”

Ethereum

Section titled “Ethereum”
  • MEV-Boost — Flashbots’ out-of-protocol PBS; ≈90% of blocks (as of 2023-05), 91.8% (as of 2023-12). boost.flashbots.net
  • Relays and builders — six relays / five entities delivered 99% of MEV-Boost blocks (as of 2023-05); top three builders (beaverbuild, Titan, BuilderNet) produce ≈90% of blocks (as of 2025-07, Helius citing public dashboards). See /foundations/mev-supply-chain/.
  • EIP-7732 (ePBS) — headliner of the Glamsterdam upgrade together with EIP-7928 block-level access lists, targeting mainnet in Q4 2026 (as of 2026-08, secondary: Ethereum Foundation Checkpoint #9 and ecosystem coverage).
  • Inclusion lists (FOCIL, EIP-7805) — the censorship-resistance complement to PBS; see /mev/mev-burn-tickets-focil-timing/.

Solana

Section titled “Solana”
  • n/a as full-block PBS — Solana’s leader builds, orders, and executes its own block; there is no builder market and no relay. The analogous roles: the leader’s scheduler (fee-priority ordering, Agave 1.18 central scheduler since May 2024) and the Jito block engine, an off-chain auction for partial blocks (bundles of up to five transactions) that the Jito-Solana client reserves compute for at the start of its block; see /mev/solana-mev/.
  • BAM (Block Assembly Marketplace, announced July 2025) — TEE-based “BAM nodes” sequence transactions and validators execute them in the given order, which Helius describes as moving Solana “closer to a PBS-like architecture”; Jito ran seven block engines and targets 50–100+ BAM nodes (as of 2025-07).

6. Risks, attacks, and incidents

Section titled “6. Risks, attacks, and incidents”
  • April 2–3, 2023 relay exploit (“Low-Carb Crusader”). A proposer sent the Flashbots-based relay an invalid signed header (state root and parent root set to zero). The relay failed to validate it, tried and failed to publish, and still revealed the block body. The proposer then published its own block that reordered a sandwich bot’s bundles against them, stealing about $20M from searchers whose bundles had been aggregated by builder0x69 (Flashbots post-mortem; Paradigm, 2023-04). Fixes: relays stopped returning bodies unless publication succeeded, validated blocks before broadcast, and checked for equivocations; a 2 s then 3 s getHeader cutoff was added.
  • Consensus instability from the fix (April 6, 2023). The patches added latency to relay publication; with honest-reorg rules, late relay blocks were reorged. Metrika data showed 13 blocks (4.3%) reorged in the worst hour, ~5× normal (as of 2023-04); several patches were rolled back.
  • Shapella Prysm bug (April 2023). A bug in Prysm’s MEV-Boost code path caused a brief 10× spike in missed slots at the fork (Neuder & Drake, 2023-05).
  • Relay and builder censorship. Post-Merge some relays filtered OFAC-sanctioned addresses; two of the top three builders were filtering while 90% of validators were not (as of 2024-06).
  • Equivocation attacks. A proposer with ≥30% attestation weight on a competing fork can still unbundle a revealed payload; two-slot ePBS inherits this unless headlock is added (D’Amato & Neuder, 2023-04).
  • Builder centralization. jgm’s 2022 prediction that searchers rationally send bundles to the builder with the best pool, creating a feedback loop toward a single builder, has largely played out: three builders ≈90% of blocks (as of 2025-07), with builder–searcher vertical integration (Wintermute–rsync, SCP–beaverbuild, as of 2023-10).

7. Open problems

Section titled “7. Open problems”
  • What exactly to enshrine. Monnot (“Unbundling PBS”, 2022) and Neuder & Drake note MEV-Boost is a block auction, but the protocol could instead enshrine a slot auction (sell the proposing right, let the buyer build later); execution tickets and execution auctions are the slot-auction branch (see /mev/mev-burn-tickets-focil-timing/).
  • Relay bypassability. Terence (2024) observes that ePBS “is not about removing the relayer” but about letting validators and builders transact without one; whether relays persist for latency or as builder-relays is an open market question (Flashbots’ “Relays in a post-ePBS world”, 2023).
  • Slot timing. Two-slot designs need longer slots; PTC-style designs keep 12 s but shrink margins. ePBS complexity was the main bottleneck to Glamsterdam testnets (as of 2026-08, secondary).
  • Does TEE or threshold encryption fully replace relay validation? Paradigm’s design covers privacy but needs TEE or ZK proofs (or collateral) for validity; TEE trust is its own debate (see /mev/encrypted-mempools/).

8. Ethereum vs Solana

Section titled “8. Ethereum vs Solana”
AspectEthereumSolana
Who builds the blockspecialized builders (MEV-Boost), proposer signs blindthe scheduled leader builds and executes
Escrow / trust layerrelays (trusted by both sides)none; Jito block engine is a trusted off-chain auctioneer for bundles only
Unit auctionedwhole blockbundles (≤5 txs) competing on tips at 50 ms ticks
Proposer knowledge of contentsnone before signingfull (leader sees everything it includes)
RoadmapePBS (EIP-7732) in Glamsterdam; FOCIL in HegotáBAM: TEE sequencing nodes + validator executors (phased, 2025–)
Concentration metrictop 3 builders ≈90% of blocks (2025-07)Jito-Solana client ≈92% of stake (2025-01)

Ethereum chose to separate proposing from building so that the validator set could stay dumb and decentralized while builders centralize; the cost was a trusted relay layer that the protocol is now trying to absorb. Solana kept building inside the leader and relies on stake-weighted leader rotation and, increasingly, on Jito’s off-chain auction; its version of the relay-trust problem is that the Jito block engine and BAM nodes are operated by one company, which BAM tries to address with TEE attestations rather than consensus changes.

9. Reference doc

Section titled “9. Reference doc”

The reference

Section titled “The reference”

Why enshrine Proposer-Builder Separation? A viable path to ePBS — Mike Neuder, Justin Drake, 2023-05-25. https://ethresear.ch/t/why-enshrine-proposer-builder-separation-a-viable-path-to-epbs/15710

Summary of the reference

Section titled “Summary of the reference”

The post’s tl;dr frames PBS as decoupling block proposing (validators) from block building (MEV searchers/builders) so that validators “can continue running on consumer-grade hardware without missing out on the valuable MEV”, notes MEV-Boost accounts for ≈90% of blocks, and lists the events (Low-Carb Crusader, the Prysm Shapella bug, the relay response) that refocused attention on enshrinement.

“Reasons to enshrine” has three heads. Relays oppose Ethereum’s values: decentralization (six relays, five entities, 99% of blocks), censorship resistance (relays were pressured to filter OFAC addresses), and trustlessness (validators trust relays for valid headers and publication; builders trust them not to steal). Out-of-protocol software is brittle: the $20M+ unbundling, the 5× reorg spike, the 10× missed-slot spike, and the recurring coordination cost of keeping relays compatible at every hard fork. Relays are expensive public goods: $20k–100k per year with no funding model.

“Reasons not to enshrine” are presented with responses: “if it ain’t broke”, alternative MEV tools (SUAVE, CoW, MEVBlocker), roadmap priority (they argue ePBS depends on single-slot finality and validator-set consolidation via MaxEB), and “what is the right thing to enshrine” (block vs slot auctions).

The “ePBS design space” enumerates six properties: honest builder publication safety, honest builder payment safety, honest proposer safety, permissionlessness, censorship resistance (“if we rely on altruism, don’t make altruism expensive”), and roadmap compatibility. It then sketches Two-Block HeadLock (TBHL): a single slot produces a proposer block committing to an execution payload and then a builder block containing it, each with its own attestation round, incorporating headlock to protect builders from proposer equivocation. The post admits slot time would likely need to increase.

Finally, the optimistic relaying roadmap: relays progressively stop simulating blocks from collateralized builders, which reduces latency now and moves the trust model step by step toward what ePBS would enforce.

Key quotes

Section titled “Key quotes”

“mev-boost implements out-of-protocol PBS and accounts for ≈90% of Ethereum blocks.” (tl;dr)

“Six relays, operated by five different entities, account for 99% of mev-boost blocks.” (§Reasons to enshrine)

“The ‘Low-Carb Crusader’ unbundling exploited a relay vulnerability for 20+ million USD.” (§Reasons to enshrine)

“Relay operational costs range from ≈20k-100k USD per-year depending on the desired performance.” (§Reasons to enshrine)

“We believe that ePBS depends on Single-Slot Finality (SSF) for security and complexity reasons.” (§Reasons not to enshrine)

How to read the original

Section titled “How to read the original”

Background: the MEV-Boost flow (getHeader/getPayload), Ethereum’s slot structure and attestation deadline, and proposer boost. Read the tl;dr, “Reasons to enshrine”, and the six properties first; skip TBHL’s timing figure and the optimistic-relay section on a first pass. The hardest part is the TBHL slot anatomy: two sequential attestation rounds in one slot, where the second round’s votes both confirm the builder block and give it fork-choice weight; the reason it needs headlock is that a proposer could publish two proposer blocks with different headers and split the first-round attesters.

What changed since

Section titled “What changed since”
  • 2023-07: Payload-Timeliness Committee (PTC) design keeps a 12 s slot with a small committee attesting to payload timeliness.
  • 2024-02: “Minimal ePBS – Beacon Chain Changes” (Terence) and Potuz’s spec work became EIP-7732.
  • 2024-10: Paradigm’s “How to Remove the Relay” proposed threshold encryption to attesters as an alternative to enshrinement.
  • 2024-11: BuilderNet launched TEE-based multi-operator building; ~40% of Ethereum blocks were built in TEEs (as of 2025-07, Helius, secondary).
  • 2025–2026: EIP-7732 selected as Glamsterdam headliner; FOCIL deferred to Hegotá; mainnet targeted Q4 2026 (as of 2026-08, secondary).

Secondary references

Section titled “Secondary references”
  1. “Two-slot proposer/builder separation” (Buterin, 2021) — read if you want the original in-protocol design and its payment-safety logic.
  2. “How to Remove the Relay” (Paradigm, 2024) — read if you want the cryptographic alternative to enshrinement.
  3. “Time, slots, and the ordering of events in Ethereum Proof-of-Stake” (Paradigm, 2023) — read if you want the April 2023 incident and fork-choice timing explained.
  4. “MEV-Boost: Merge ready Flashbots Architecture” (ethresear.ch/11177, 2021) — read if you want the role definitions and trust assumptions as originally specified.
  5. “Equivocation attacks in mev-boost and ePBS” (D’Amato & Neuder, 2023) — read if you want the headlock mechanism.

The reference

Section titled “The reference”

How to Remove the Relay — Charlie Noyes, Guru Vamsi Policharla (Paradigm), 2024-10-08. https://www.paradigm.xyz/writing/removing-the-relays

Summary of the reference

Section titled “Summary of the reference”

The post proposes replacing relays with “direct, cryptographically private communication between builders and proposers” via non-interactive silent threshold encryption using validators’ existing BLS keys. It first restates the relay’s two roles (builder privacy, proposer safety) and its costs: ~90% of blocks through a handful of relays, colocation incentives that undermine geographic decentralization, and 5–20 ms of end-to-end latency. It then reviews TEE-Boost, where builders prove bid honesty and block validity in a TEE but face a data availability problem (the builder may withhold the body after the header is signed); the proposed fixes (TEE escrow, external DA layers) reintroduce relay-like latency or new assumptions.

The core mechanism: the builder threshold-encrypts the block to a fraction of the slot’s attester committee, produces a TEE proof that the bid is honest, the block valid, and the encryption correct, and sends both to the proposer; the proposer signs the encrypted proposal; once the threshold of attesters attests, the block decrypts and proceeds. Performance: constant-time encryption and partial decryption, +768-byte ciphertexts, aggregation cost scaling with committee size. Data publication: a KZG-style reference string plus per-validator “hints” of ~3 KB, ~3 GB for ~1M validators, expected to fall with MaxEB. Liveness: builders choose the threshold tt to trade privacy against the risk of an offline committee, with relays or self-building as opt-in fallbacks; undecryptable blocks are simply forked out. The post ends by arguing adoption can be market-driven if latency beats multi-hop relaying.

Key quotes

Section titled “Key quotes”

“Approximately 90% of blocks on Ethereum are delivered through just a handful of relays.” (§MEV-Boost and the Role of Relays)

“The average end-to-end block processing latency of efficient relays is around 5-20 milliseconds.” (§MEV-Boost and the Role of Relays)

“We propose an elegant solution to TEE-Boost’s DA problem: threshold encryption to the attester committee.” (§Threshold Cryptography)

“The ciphertext size is a constant additive factor, 768 bytes, larger than the plaintext” (§Performance)

How to read the original

Section titled “How to read the original”

Background: MEV-Boost roles, BLS aggregation, and what a threshold scheme is. Skip the hint-size arithmetic on first read. The hardest paragraph is the liveness trade-off: a higher threshold tt means fewer attesters can collude to decrypt early (better privacy) but a higher chance the block never decrypts if attesters are offline, so builders must price that risk themselves.

What changed since

Section titled “What changed since”
  • 2025-05: Unichain shipped a TEE block builder (Rollup-Boost) on an L2, demonstrating TEE proofs of ordering in production.
  • 2025–2026: ePBS (EIP-7732) advanced toward Glamsterdam; the threshold-encryption path remains a research proposal (as of 2026-08).

Secondary references

Section titled “Secondary references”
  1. “Silent Threshold Encryption” (Garg et al., ePrint 2024/263) — read if you want the cryptography.
  2. “TEE-Boost” (Flashbots Collective) — read if you want the TEE-only alternative this post improves on.
  3. “Relays in a post-ePBS world” (ethresear.ch/16278, 2023) — read if you want the list of relay roles that any replacement must cover.

10. Sources

Section titled “10. Sources”