💻 computer science

MEV-ACE: Identity-Authenticated Fair Ordering for Proposer-Controlled MEV Mitigation

This paper introduces MEV-ACE, a single-slot, post-quantum compatible protocol that mitigates proposer-controlled MEV by combining slashable economic identities, authenticated commit-open messages with validator thresholds, and verifiable delay randomness to ensure fair, unpredictable, and accountable transaction ordering without requiring a threshold decryption committee.

Original authors: Jian Sheng Wang

Published 2026-04-10

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jian Sheng Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a high-stakes poker game where the dealer (the Block Producer) has a superpower: they can see everyone's cards before anyone else, and they get to decide the order in which the cards are played.

In the world of blockchain, this dealer is called the "Block Producer." Because they see the pending transactions (the "cards") first, they can cheat in three main ways:

Front-running: They see you trying to buy a token, so they buy it first to make the price go up, then sell it to you at a higher price.
Sandwich attacks: They buy before you and sell after you, stealing the profit from the price difference you caused.
Censorship: They simply refuse to let your card into the game if it doesn't benefit them.

This paper, MEV-ACE, proposes a new set of rules to stop the dealer from cheating, without needing a trusted third party to watch over them.

Here is how it works, using simple analogies:

1. The "Real ID" Badge (Identity Authentication)

The Problem: In the old system, anyone could walk up to the table and shout out a bet. A cheater could shout out 1,000 fake bets just to confuse the dealer and mess up the order.
The MEV-ACE Solution: Before you can place a bet, you must wear a Real ID Badge that is tied to your money.

You have to lock up a deposit (a "bond") to get this badge.
If you try to cheat or spam the table with fake bets, the system takes your deposit.
The Analogy: It's like a VIP club where you can't just walk in; you have to leave your car in the valet. If you try to cause a scene, they keep your car. This stops people from spamming the system with fake orders.

2. The "Sealed Envelope" with a Witness (Authenticated Commitments)

The Problem: Even with IDs, the dealer could still ignore your bet if they didn't like it, and no one would know.
The MEV-ACE Solution: When you want to make a move, you don't just shout it out. You put your bet in a Sealed Envelope and hand it to a group of Witnesses (the Validators).

The Witnesses check your ID and sign the envelope to say, "Yes, this is a valid bet from a real person."
Once enough Witnesses sign it, the envelope becomes mandatory. The dealer must play this card later.
The Analogy: Imagine you put your bet in a locked box and get 10 security guards to stamp it. Once the box has 10 stamps, the dealer is legally forced to open it. If they ignore it, the guards have a signed paper proving the dealer broke the rules.

3. The "Magic Hourglass" (Verifiable Delay Randomness)

The Problem: Even with sealed envelopes, a smart dealer might wait until the last second to see which envelopes are valid, then decide the order of the game to make the most money for themselves.
The MEV-ACE Solution: The order of the game is decided by a Magic Hourglass (called a VDF).

First, all the valid envelopes are collected and locked in a vault.
Then, the Magic Hourglass starts. It takes a specific amount of time (say, 10 seconds) to grind out a random number that determines the order.
Crucially: The dealer cannot speed up the hourglass. They have to wait.
The Analogy: Imagine the dealer has to wait for a slow, magical clock to tick down before they can see the "shuffled deck." By the time the clock finishes, the list of valid bets is already locked in. The dealer can't change the order based on what's inside the envelopes because they didn't know the order until it was too late.

4. The "Receipt" System (Accountable Inclusion)

The Problem: What if the dealer says, "I didn't see your envelope"?
The MEV-ACE Solution: Every time you get your envelope stamped by the witnesses, you get a Digital Receipt.

If the dealer leaves your bet out of the final game, you can show your receipt to the whole room.
The room (the network) sees the receipt, checks the math, and says, "Hey, the dealer broke the rules!"
The Analogy: It's like getting a ticket at a concert. If the bouncer (the dealer) tries to kick you out, you show your ticket. If the ticket is valid, the bouncer gets fired (or loses their deposit).

The Result: A Fair Game

By combining these four things, MEV-ACE creates a system where:

You can't spam the system (because of the ID/Bond).
The dealer can't ignore you (because of the Witness Stamps).
The dealer can't cheat the order (because of the Magic Hourglass).
The dealer can't lie about what happened (because of the Digital Receipts).

If the dealer tries to cheat, they lose their own money (their bond). If they play fair, they make a normal profit. The paper argues that when the penalty for cheating is higher than the profit from cheating, the dealer will naturally choose to be honest.

In short: MEV-ACE turns the blockchain from a game where the dealer can rig the deck into a game where the deck is shuffled by a slow, un-runnable machine, and every card is tracked by a group of honest witnesses.

1. Problem Statement

The paper addresses Maximal Extractable Value (MEV), specifically ordering-based MEV, where block producers (proposers) exploit their unilateral discretion to observe pending transactions and manipulate their inclusion or order for profit. This leads to three primary attack vectors:

Front-running: Inserting a transaction before a target to capture price movements.
Sandwich attacks: Bracketing a target transaction with buy/sell orders to extract slippage.
Censorship: Selectively excluding transactions to disadvantage specific users.

Limitations of Existing Solutions:
Current mitigation strategies (Commit-Reveal, Threshold Encryption, Fair Ordering Services, Proposer-Builder Separation) suffer from two critical gaps:

Lack of Authenticated Admissibility: Commitments are not tied to slashable, registered identities, allowing producers to "stuff" the ordering pool with low-cost fake commitments to dilute competition.
Lack of Verifiable Inclusion Obligations: There is no portable, transferable evidence (receipts) that a transaction was mandatory to include. If a producer omits a valid transaction, other validators cannot easily prove the omission without relying on local observation.

2. Methodology: The MEV-ACE Protocol

MEV-ACE is a single-slot protocol designed to eliminate unilateral proposer discretion over admitted transactions. It integrates three core mechanisms:

A. Registered Economic Identities (ACE-GF Framework)

Identity Derivation: Users derive application-specific authentication keys deterministically from a Root Entropy Value (REV) using the ACE-GF (Atomic Cryptographic Entity Generative Framework). This ensures context isolation and post-quantum compatibility (e.g., ML-DSA-44).
Bonded Participation: Users register an on-chain tuple (idcom, vk_auth, D_stake), where D_stake is a slashable bond.
Anti-Stuffing: Each identity is limited to a quota ( $\ell$ ) of commitments per slot. Exceeding this requires registering new identities, which locks additional capital.

B. Threshold Receipts for Admissibility

The protocol introduces a two-phase commitment process requiring validator consensus:

Commit Phase: Users broadcast a commitment $c_i = H(tx_i \parallel r_i \parallel id_i \parallel s)$ signed by their auth key. Validators verify the signature and the identity's bond. Once a threshold ( $q_c \ge 2f+1$ ) of validators sign a receipt, the commitment becomes admissible.
Open Phase: After the order is determined, users reveal the transaction and nonce. Validators verify the opening against the commitment. A threshold ( $q_o \ge 2f+1$ ) of receipts creates an executable opening.

Accountability: If a producer omits a transaction with valid receipts, any participant can submit an omission proof to invalidate the block.

C. Verifiable Delay Randomness (VDF)

Ordering Mechanism: The execution order is determined only after the set of admissible commitments is locked.
Process: The producer computes a seed from the Merkle root of the admissible set and a previous block hash. This seed is fed into a Verifiable Delay Function (VDF).
Security: The VDF output (the random seed for shuffling) takes $T$ sequential steps to compute but is instantly verifiable. This creates a mandatory delay between locking the transaction set and knowing the order, preventing the producer from selectively revealing only profitable transactions.

3. Key Contributions

Formal Model of Admissible Fair Ordering: Defines a security model where commitments become mandatory only after collecting threshold validator receipts, formalizing three properties: Order-Unpredictability, Commitment Authenticity, and Accountable Inclusion.
The MEV-ACE Protocol: A single-slot architecture combining ACE-GF identity derivation, threshold receipts, and VDF-based delayed randomness without requiring a threshold decryption committee.
Security Proofs:
- Order-Unpredictability: Proven under the sequentiality assumption of VDFs; the order cannot be predicted before the admissible set is fixed.
- Commitment Authenticity: Proven under EUF-CMA security of the signature scheme; only registered identities can create valid commitments.
- Accountable Inclusion: Proven under BFT assumptions; any transaction with valid commit/open receipts must be included, or the block is provably invalid.
Economic Incentive Analysis: Demonstrates that if the cost of bonds and slashing penalties ( $\delta \cdot \text{Bond}$ ) exceeds the potential gain from manipulation, honest execution is the producer's best response.
Deployment Guidance: Separates cryptographic delay parameters from wall-clock runtime, providing a framework for latency budgeting ( $\Delta_{slot} = \Delta_c + \Delta_v + \Delta_o + \text{margin}$ ).

4. Results and Security Properties

Under standard cryptographic assumptions (EUF-CMA, collision resistance, VDF sequentiality) and economic parameters:

Elimination of Discretion: Once the admissible set is fixed, the producer cannot reorder or omit transactions without incurring a provable block invalidation or a financial penalty exceeding the potential MEV gain.
Sybil Resistance: Commitment stuffing is made economically prohibitive. To inject $k$ extra commitments, an adversary must lock $\lceil k/\ell \rceil \cdot D_{stake}$ in bonds.
Post-Quantum Compatibility: The protocol supports post-quantum signatures (ML-DSA-44) via the ACE-GF framework.
No Threshold Decryption: Unlike threshold encryption schemes, MEV-ACE does not require a trusted decryption committee, reducing latency and trust assumptions.

5. Significance

MEV-ACE represents a shift from hiding transaction contents (encryption) to authenticating transaction admission (identity and receipts).

Structural Change: It moves the security boundary from "trusting the proposer not to cheat" to "cryptographically and economically enforcing inclusion."
Practicality: By operating within a single slot and avoiding complex decryption committees, it offers a more deployable path for existing blockchains compared to multi-round commit-reveal or threshold encryption systems.
Scope: It specifically targets proposer-controlled ordering MEV. It acknowledges that information-based MEV (e.g., arbitrage on public oracle updates) requires orthogonal solutions like batch auctions.

In conclusion, MEV-ACE provides a rigorous framework where fair ordering is guaranteed by the combination of registered identity, threshold receipts, and delayed randomness, making unilateral manipulation economically irrational and cryptographically provable.