💻 computer science

Reveal, Correct, Then Pay: Encrypted Mempools and Perpetual Funding Security

This paper argues that encrypted mempools, while effective against maximal extractable value, inadvertently create a security vulnerability in perpetual futures funding by preventing immediate corrective arbitrage during the commit phase, thereby amplifying state manipulation attacks through economic reaction gaps and reduced price capitalization.

Original authors: Benjamin Marsh

Published 2026-07-16

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Benjamin Marsh

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the digital world of cryptocurrencies as a massive, bustling marketplace where people trade digital assets every second. In this market, there's a special waiting room called a "mempool" where transactions sit before they are officially processed and added to the public record. Usually, this waiting room is like a glass box: everyone can see what you are buying or selling before the deal happens. This transparency has a downside: sneaky bots can peek at your order, jump in front of you to buy the same thing cheaper, and then sell it to you at a higher price a split second later. This is called "front-running," and it's like someone seeing you about to buy a concert ticket and buying the best seat first just to sell it to you for double.

To stop this, engineers invented "encrypted mempools." Think of this as putting every transaction into a locked, unbreakable safe. The safe travels through the system, and no one can see what's inside until the exact moment the transaction is officially placed in line. This stops the sneaky bots from seeing your specific trade and jumping the queue. It sounds like a perfect solution, right? Well, this paper asks a tricky question: What if the person putting the transaction in the safe is the one trying to cheat? What if the attacker knows exactly what they are doing, but the market doesn't? The paper explores whether hiding the transaction actually helps the attacker by blinding the market's natural "correctors"—the people who usually fix price mistakes—while the attacker still knows their own plan.

This paper, titled "Reveal, Correct, Then Pay," investigates a specific type of cheating in the world of "perpetual futures," which are long-term bets on the price of an asset. The authors, Benjamin Marsh from Sei Labs and the University of Portsmouth, argue that while encrypted mempools are great at stopping attacks on other people, they can accidentally make it easier for an attacker to manipulate the market for themselves.

The core of the problem is a timing gap. In a normal market, if someone tries to push a price up or down, other traders see it immediately and jump in to fix it, making the price fair again. But with encrypted mempools, the market has to wait for the "safe" to be opened before it can see the manipulation. By the time the safe opens and the market realizes what happened, the attacker has already set up their trap. The paper shows that this delay creates a "reaction gap." Even if the safe opens in a fraction of a second, that tiny delay is enough to stop the market's natural fixers from acting in the same batch of transactions.

The authors model this using the concept of "funding rates," which are payments made between traders to keep the price of a perpetual bet close to the real market price. An attacker can hide a transaction that slightly distorts this price signal. Because the market is blind during the encryption phase, the distortion lasts longer than it would in a transparent market. The paper proves that this extra time allows the attacker to collect more money. Specifically, they find that the profit an attacker makes isn't just a little bit higher; it is quadratic in the product of the attacker's targeting ability and the response factor (which includes the persistence of the distortion). This means if the attacker's ability to target the market stays the same, but the market's ability to correct the mistake slows down even a little, the attacker's potential profit can still increase significantly, driven by that combination of skill and delay.

The paper explicitly rules out the idea that encryption is a universal shield against all manipulation. It argues that for "self-authored" attacks—where the attacker is the one creating the transaction—hiding the order doesn't hide the attacker's intent from themselves, but it does hide it from the market's defenders. The authors show that if an attacker already holds a position (like a bet on the price going up), they can use encryption to distort the price signal, wait for the market to open the safe, and then collect a payout that is much larger than it would have been if the market could react instantly.

However, the paper doesn't just point out a problem; it offers a solution. The authors propose a new rule for how these markets should work: "Reveal, Correct, Measure, Then Pay." Instead of opening the safe and immediately paying out based on the new price, the system should wait. It should open the safe, let the market's "correctors" see the distortion and fix it, measure the price after that correction, and then pay out. This creates a "correction buffer" that gives the market time to heal the wound before the attacker gets their reward.

The authors are very precise about their findings. They use mathematical models and simulations to show that this "reaction gap" is a real, measurable danger. They calculate that even a small delay can significantly increase the attacker's profit, especially if the market usually corrects mistakes very quickly. They also introduce a "security index" that breaks down the risk into three parts: how blind the attacker is, how well the market is shielded from correcting, and how much the market capitalizes on the predictable payout. Their math shows that encryption can actually be harmful if it protects the attacker's ability to hide their entry price while simultaneously blinding the market's ability to fix the price.

In short, the paper suggests that while locking transactions in a safe is great for protecting innocent users from being sniped, it can backfire if the system doesn't have a built-in "cooling off" period. If the market opens the safe and immediately pays out, it's like letting a thief set a trap and then handing them the keys to the vault before anyone can stop them. The solution is to open the safe, let the guards fix the mess, and then hand over the keys. This ensures that privacy protects users without giving attackers a free pass to manipulate the system.

Technical Summary: Reveal, Correct, Then Pay

Problem Statement
Encrypted mempools are designed to mitigate Maximal Extractable Value (MEV) by hiding transaction contents until execution order is fixed, thereby preventing front-running and sandwich attacks that rely on observing victim transactions. However, this paper identifies a distinct vulnerability in self-authored state manipulation, specifically within the context of perpetual futures funding. In these attacks, the adversary authors the transaction that distorts the state (e.g., the funding signal) and simultaneously holds a downstream claim (receiving notional) whose payoff increases with that distortion.

The core issue is not cryptographic latency but economic reaction latency. In a "commit-then-reveal" design, once a batch is committed, no new transaction can be admitted to that batch. Even if decryption is instantaneous, an adaptive corrective transaction (e.g., an arbitrageur restoring a price) cannot execute within the same committed batch because it depends on the revealed plaintext. This creates a discrete reaction gap ( $\delta$ ) where the distortion persists without correction. Furthermore, encryption can suppress the capitalization of predictable funding into entry prices, allowing attackers to enter receiving positions cheaply before the distortion is fully priced in.

Methodology
The paper constructs a micro-founded economic model analyzing the interaction between protocol ordering rules and market correction mechanisms.

Protocol Model: The authors define a "Commit, Reveal, Execute, React" sequence. They formalize the Ordering Barrier (Lemma 1), proving that without post-commit admission or pre-committed contingent programs, adaptive corrections computed after reveal cannot execute in the committed batch.
Correction Dynamics: The correction sector is modeled as a set of arbitrageurs with Poisson-distributed opportunity arrivals, local price impact ( $\ell$ $ℓ$ ), and inventory costs ( $k_i$ $k_{i}$ ). The authors derive two correction rates:
- $\rho_c$ : The correction rate during the closed stage (limited to pre-committed or native mechanisms).
- $\rho_p$ : The correction rate after the reaction gap (including ordinary adaptive searchers).
- The model establishes that $\rho_p \geq \rho_c$ , with strict inequality whenever ordinary adaptive capacity exists.
Distortion and Payoff: The expected distortion entering a funding window is calculated as a function of the reaction gap $\delta$ , the rates $\rho_c$ and $\rho_p$ , and the window length $W$ . This yields a response factor $g(\delta; \rho_c, \rho_p, W)$ , which amplifies the attack value.
Two-Ledger Structure: The model separates the Signal Ledger (the funding rate) from the Tax Base Ledger (the receiving notional). It analyzes how visibility affects the capitalization of predictable funding into entry prices via a coefficient $\zeta$ .
Security Index: A local security index $\Gamma$ is derived to determine if an attack is scalable. The paper compares the expected value of attacks under public ($pub$) and encrypted ($enc$) regimes.

Key Contributions

The Ordering Barrier: The paper isolates a causal property of commit-then-reveal designs where the inability to admit post-reveal transactions creates a discrete economic reaction gap, independent of decryption speed.
Reaction Gap Manipulation: The authors derive the exact expected value of a one-shot distortion attack. They show that the response factor $g$ is strictly increasing in the reaction gap $\delta$ whenever $\rho_p > \rho_c$ . Consequently, encryption can increase attack profitability if the attacker retains sufficient targeting ability ( $m$ ) and the gain in distortion persistence outweighs the loss of information.
Two-Ledger Privacy Multiplier: The paper introduces a decomposition of encryption effects into three components:
- Attacker Blindness: Loss of targeting ability ( $m$ ).
- Correction Shielding: The increase in distortion persistence due to the reaction gap ( $g$ ).
- Capitalization Shielding: The reduction in entry price capitalization due to hidden entry ( $\zeta$ ).
  The security index $\Gamma$ combines these, showing that encryption can be harmful if the shielding effects dominate the blindness effect.
Decryption-Aware Funding Rule: The paper proposes a specific protocol sequence: Reveal, Correct, Measure, Then Pay. This involves inserting a public reaction buffer after reveal but before the funding signal is measured and positions are finalized.

Results

Amplification of Attack Value: For self-authored attacks, encryption can increase the expected value of manipulation. Specifically, if the attacker retains more than a critical fraction of their public targeting ability ( $m_{enc}/m_{pub}$ ), the increase in the response factor $g$ (due to the reaction gap) and the reduction in capitalization costs can outweigh the loss of information.
Thresholds: The paper derives explicit thresholds. For example, in a scenario with no closed-stage correction and a reaction gap of 10% of the funding window, the attack value can increase by a factor of ~3.24 if targeting ability is unchanged. Encryption remains harmful if the attacker retains >56% of their public targeting ability in this specific case.
Capitalization Channel: The "tax base" channel is shown to be a powerful amplifier. If public visibility causes 80% of predictable funding to be bid into entry prices, but encryption reduces this to 0%, the threshold for encryption to be harmful drops significantly (e.g., to ~11% targeting retention).
Ineffectiveness of Fast Decryption Alone: The results demonstrate that reducing cryptographic latency (decryption time) is necessary but insufficient. If the protocol closes admission before reveal, the ordering barrier remains, and the economic reaction gap persists.

Significance and Claims
The paper claims that encrypted mempools do not universally reduce economic manipulation. While they effectively protect against victim-dependent MEV, they can inadvertently facilitate self-authored state manipulation by shielding the attacker from corrective market forces and entry price capitalization.

The authors argue that the security of state-dependent transfers (like perpetual funding) depends on the application's ability to adapt to the information schedule created by encryption. They conclude that transaction privacy and market integrity are compatible only when the application is designed for the specific information schedule that encryption creates. The proposed solution is not to abandon encryption, but to compose it with application-level mechanisms that allow for correction and capitalization after reveal but before payment, effectively closing the reaction gap and restoring market efficiency.

Technical Summary: Reveal, Correct, Then Pay

More like this