Sealed-Bid Auction

What Is a Sealed-Bid Auction?

A sealed-bid auction is a type of auction where every participant submits their bid privately, without knowledge of what others have offered. All bids are revealed at the same time after the submission period closes, and the winner is determined by a predefined rule. Unlike open auctions where participants can see competing bids and adjust in real time, the sealed-bid format forces each bidder to commit to a single price based solely on their own valuation.

The concept has deep roots in procurement and government contracting, where sealed tenders have been used for centuries to prevent collusion. In 1961, economist William Vickrey formalized the theory of sealed-bid auctions and introduced the second-price variant that now bears his name. The Vickrey auction later became a cornerstone of mechanism design, the field that works backward from desired outcomes to the rules that achieve them.

In the cryptocurrency space, sealed-bid auctions solve a specific problem: transparent blockchains make all transaction data publicly visible, enabling front-running and bid sniping. A sealed-bid mechanism, implemented through cryptographic commitments, restores the privacy needed for fair price discovery.

How It Works

The mechanics of a sealed-bid auction depend on two choices: the bidding format (first-price or second-price) and the enforcement method (trusted auctioneer or cryptographic protocol).

First-Price Sealed-Bid Auction

In a first-price auction, the highest bidder wins and pays exactly what they bid. Because the winning bid becomes the price, rational bidders shade their bids below their true valuation. Bidding your actual maximum guarantees zero surplus if you win: you pay exactly what the item is worth to you.

This creates a strategic tension. Bidding lower increases your profit if you win but decreases your chance of winning. There is no dominant strategy: the optimal bid depends on assumptions about how many other bidders participate and how they value the item. First-price auctions are common in government procurement, real estate, and block space allocation.

Second-Price (Vickrey) Sealed-Bid Auction

In a second-price auction, the highest bidder wins but pays the second-highest bid amount. This seemingly counterintuitive rule produces a powerful result: bidding your true valuation is a weakly dominant strategy. Your bid determines only whether you win, not what you pay. Raising your bid above your true value risks overpaying if you win, while lowering it risks losing an auction you would have won profitably.

This truthfulness property makes second-price auctions attractive for protocol design. The auctioneer extracts honest price signals without requiring bidders to solve complex optimization problems. The Vickrey format generalizes to multi-item settings through the Vickrey-Clarke-Groves (VCG) mechanism, where each winner pays the externality they impose on other participants.

Commit-Reveal on Blockchains

Public blockchains present a paradox for sealed-bid auctions: all transaction data is visible to every participant. If a bidder submits their bid as a plain transaction, anyone watching the mempool or the chain can see it and adjust accordingly. The solution is a commit-reveal scheme, which splits the auction into two distinct phases.

The commit-reveal process works as follows:

1. Commit phase: each bidder computes a cryptographic hash of their bid amount combined with a random secret (salt) and submits this hash to the auction smart contract. The hash is binding: the bidder cannot change their bid later. However, the hash reveals nothing about the bid amount.
2. Reveal phase: after the commit window closes, bidders submit their original bid amount and salt. The contract hashes these values and verifies the result matches the earlier commitment. Invalid reveals are rejected.
3. Settlement: the contract compares all valid revealed bids, determines the winner by the auction rules, transfers the asset, and refunds losing bidders.

// Simplified commit-reveal auction in Solidity
// Commit phase
bytes32 commitHash = keccak256(abi.encodePacked(bidAmount, salt));
auction.commit{value: deposit}(commitHash);

// Reveal phase (after commit window closes)
auction.reveal(bidAmount, salt);

// Contract verifies:
// keccak256(abi.encodePacked(bidAmount, salt)) == storedCommitHash

A critical design detail: bidders typically must attach a deposit larger than their actual bid during the commit phase. If the deposit equaled the bid exactly, observers could infer the bid amount from the transaction value. Over-depositing hides the true bid, with the excess returned after the reveal.

Use Cases

ENS Domain Name Registration

The Ethereum Name Service (ENS) originally used a Vickrey-style sealed-bid auction for domain registration. Bidders committed a hash of their desired name, bid amount, and a secret during a three-day bidding window. After the window closed, a 48-hour reveal period allowed bidders to unmask their bids. The highest bidder won the name and paid the second-highest bid, with the difference refunded.

ENS later moved to an instant registration model with a two-step commit-reveal process that uses a 60-second waiting period instead of a multi-day auction. The original auction format was retired because most registrations attracted only a single bidder, making the auction mechanism unnecessary overhead.

NFT Auctions

Sealed-bid auctions address a common problem in NFT sales: sniping, where bidders wait until the final seconds of an open auction to place their bid, preventing meaningful competition. In a sealed-bid format, all bids are hidden until the deadline, so last-second entries gain no informational advantage.

Projects like Nouns have experimented with daily sealed-bid NFT auctions where bidders commit hashes of their bids, attach deposits exceeding their actual bid to obscure the amount, and reveal after a fixed window. This format encourages bidders to bid their true valuation rather than engaging in strategic timing games.

MEV Block Space Auctions

Maximal Extractable Value (MEV) auctions use sealed-bid mechanisms to allocate block space fairly. In the Flashbots auction system, MEV searchers submit sealed bids for transaction bundles they want included in the next block. Block builders evaluate these bids privately and construct the most profitable block. Losing bids cost nothing since they are never executed on-chain.

This sealed-bid approach, combined with proposer-builder separation, reduces the advantage of latency-based front-running. Instead of competing on speed, searchers compete on the value they offer to block producers. Research designs like MEV-SGX have proposed using trusted execution environments to enforce bid privacy without the gas overhead of commit-reveal on-chain.

Batch Auctions and Order Flow

Batch auctions on decentralized exchanges share the sealed-bid philosophy. Protocols like CoW Protocol collect trade intents during a batch window, then settle all orders at a uniform clearing price. This batching prevents sandwich attacks and provides better execution than continuous order books in low-liquidity environments.

Why It Matters

Sealed-bid auctions solve a fundamental tension in blockchain-based markets: the transparency that makes blockchains trustworthy also makes them exploitable. Any open-bid system on a public chain is vulnerable to front-running, sandwich attacks, and strategic manipulation by participants who can observe pending transactions.

By hiding bids until the auction closes, sealed-bid mechanisms restore the conditions necessary for honest price discovery. This matters for everything from domain name registration to block space markets. The second-price variant is particularly valuable in protocol design because it incentivizes truthful bidding without requiring participants to model competitor behavior. For a deeper look at how MEV auctions reshape block production economics, see the research article on MEV, PBS, and validator economics.

Risks and Considerations

Gas Costs of Commit-Reveal

On-chain sealed-bid auctions require at least two transactions per bidder: one to commit and one to reveal. Research estimates roughly 110,000 gas for the commit transaction and 83,000 gas for the reveal, making participation significantly more expensive than a single-transaction open bid. Privacy-preserving variants using zero-knowledge proofs can push total costs above 265,000 gas per bidder.

Non-Reveal Problem

Blockchains cannot force a bidder to reveal their committed bid. A losing bidder who sees other reveals during the reveal phase might choose not to reveal at all, avoiding any cost beyond the gas spent on committing. More concerning, a winning bidder might refuse to reveal if they realize they overbid, effectively griefing the auction.

The standard mitigation is deposit forfeiture: bidders lock collateral during the commit phase, which is slashed if they fail to reveal. However, this introduces its own problem since the deposit size can leak information about the bid. If a bidder deposits exactly their bid amount, observers learn the bid from the deposit. Requiring over-deposits hides the bid but increases capital requirements for participation.

Deposit Information Leakage

Even with over-depositing, the deposit amount sets a known upper bound on the bid. Sophisticated bidders may analyze deposit patterns across multiple auctions to infer bidding strategies. Some newer designs address this by using range proofs or zero-knowledge proofs to prove that a bidder can cover their bid without revealing the amount.

Timing Attacks

The order in which commit and reveal transactions appear on-chain can leak information. A bidder who commits later in the window has seen more on-chain activity (deposit amounts, number of participants) and may adjust accordingly. During the reveal phase, the order of reveals can influence whether late bidders choose to reveal or forfeit their deposit. Research from 2025 proposes using timestamp certificates and inclusion lists to mitigate these timing leaks.

Collusion and Bid Rigging

Sealed-bid auctions are not immune to collusion. Bidders can coordinate off-chain, agreeing to suppress bids so that one participant wins at a lower price and shares the surplus. In second-price auctions specifically, the auctioneer can manipulate results by inserting a shill bid just below the winning bid, forcing the winner to pay nearly their full bid instead of a genuinely lower second price. On-chain implementations can mitigate auctioneer manipulation through transparent settlement logic, but off-chain collusion remains difficult to detect.

For further context on how auction formats compare across decentralized markets, see the glossary entries on Dutch auctions and batch auctions.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.