Scalable Off-Chain Auctions

Scalable Off-Chain Auctions

Speakers: Mohsen Minaei

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=DqdoPltUsL8

Overview

Running sealed-bid auctions on public blockchains like Ethereum faces a fundamental scalability problem: every bid requires an on-chain transaction, causing gas costs to grow linearly with the number of bidders. The current state of the art, RCTC (CCS 2023), hits the Ethereum block gas limit with just 20 bidders. This talk presents a new protocol that scales sealed-bid auctions to 1,000+ bidders with constant on-chain cost when all parties behave honestly, and O(K) cost when K bidders misbehave. The protocol achieves full post-auction privacy (only the winning bid is revealed), financial fairness through collateral and covenants, and delivers a 50x improvement over RCTC in gas costs. The key insight is that combining Programmable Payment Channels (PPCs) for off-chain execution, zk-SNARKs for zero-knowledge winner verification, and covenant contracts for on-chain dispute resolution provides better scalability than deploying heavy cryptographic primitives directly on-chain.

Background

▶ Watch: The scalability problem: RCTC hits gas limit at 20 bidders (0:30)

Sealed-bid auctions require that bids remain hidden until a reveal phase, after which the highest bidder wins. Implementing this on a public blockchain is challenging because all on-chain data is visible to anyone, and the computational cost of cryptographic privacy mechanisms can be prohibitive.

Previous approaches like RCTC use time-lock puzzles that require heavy cryptographic verification for every bid submission. This makes the smart contract gas cost grow linearly with the number of bidders, hitting Ethereum's block gas limit at roughly 20 participants -- far below the scale needed for real-world auctions.

Programmable Payment Channels (PPCs), introduced by the research team at ACNS 2024, establish a hub-and-spoke topology where a central hub maintains payment channels with all bidders. Smart contract logic can be executed off-chain through these channels, with on-chain resolution needed only when disputes arise. This decouples the common case (honest behavior) from the worst case (disputes), enabling constant-cost operation when all parties cooperate.

Zero-knowledge proofs (zk-SNARKs) allow the hub to prove that the winning bid is genuinely the highest among all committed bids without revealing any non-winning bid values. The protocol uses Groth16 for proof generation, which requires a trusted setup (mitigated through MPC ceremonies, as used in Zcash).

Key Findings

▶ Watch: Six-stage protocol overview with dispute resolution (3:00)

The protocol achieves several important properties, formally proven in the Universal Composability (UC) framework:

Scalability: Supports 1,000+ bidders with constant on-chain cost when all parties are honest. When K bidders misbehave, on-chain cost is O(K). Even with 60% malicious bidders, gas costs remain lower than RCTC for 1,000 bidders. Only at 80% malicious participation do costs approach parity.

Post-auction privacy: Non-winning bids remain hidden from external blockchain observers. Only the winning bid is revealed on-chain. This is enforced by the zero-knowledge proof, which verifies winner validity without exposing other bids.

Financial fairness: Misbehavior results in collateral slashing. Game-theoretic analysis shows it is economically irrational for either bidders or the hub to misbehave, as the cost of responding to challenges and losing collateral exceeds any potential gain.

50x gas improvement: Compared to RCTC's heavy on-chain cryptographic operations, the protocol achieves approximately 50x reduction in gas costs by moving bid processing off-chain and using a single zk-SNARK verification on-chain.

Technical Deep Dive

▶ Watch: Security properties proven in the UC framework (5:30)

The protocol operates in six stages: creation, bidding, opening, rebuttal, settling, and completion. When all parties are honest, the rebuttal stage is skipped entirely, and no on-chain interaction occurs beyond the initial contract deployment and final settlement.

Stage 1-2 (Creation/Bidding): The hub deploys an auction contract on-chain and locks collateral. Bidders submit sealed bids (commitments) to the hub through PPC channels. The hub aggregates all commitments into a Merkle tree and posts the root on-chain.

Stage 3 (Opening): Bidders reveal their bid amounts to the hub through PPC channels, proving they match their commitments. Two dispute types can arise: the hub can exclude a bid (the bidder challenges inclusion on-chain using a Merkle proof), or a bidder can refuse to open (the hub challenges the bidder on-chain to force opening).

Stage 4 (Rebuttal): A buffer period for all parties to respond to on-chain challenges. Each misbehaving bidder triggers one on-chain dispute, giving O(K) on-chain cost for K disputes.

Stage 5-6 (Settling/Completion): The hub generates a zk-SNARK proof proving: (1) the winning bid is included in the Merkle tree, and (2) the winning bid is greater than all other committed bids. The proof is submitted on-chain, the smart contract verifies it, the winner's payment is finalized, and other bidders' channels are refunded.

The hub censorship problem is addressed through governance contracts: if the hub censors a bid, the bidder can force inclusion on-chain, and the hub loses collateral if caught. While the hub is a centralized entity, it cannot cheat without economic penalty.

Demo / Proof of Concept

▶ Watch: Malicious bidder analysis: protocol remains cheaper even at 60% malicious (7:30)

The implementation uses Solidity for smart contracts and Groth16 for zk-SNARK generation. Benchmarks show the protocol scales to 1,000 bidders, compared to RCTC's maximum of 20 before hitting block gas limits. With 60% malicious bidders, the protocol still costs less than RCTC. The Merkle tree depth can be increased to support more than 1,000 bidders, at the cost of longer rebuttal periods and longer zk-SNARK proving times. The trusted setup requirement of Groth16 can be addressed through MPC ceremonies (as in Zcash) or by migrating to transparent zk-SNARK schemes like STARKs.

Defensive Implications

▶ Watch: Key takeaway: smart composition beats heavy cryptographic primitives (9:30)

For blockchain platform designers, this work demonstrates that moving computation off-chain with on-chain dispute resolution can achieve orders-of-magnitude scalability improvements over purely on-chain approaches. The PPC hub-and-spoke model provides a general template for any multi-party computation that needs blockchain-enforced fairness without blockchain-scale costs.

For organizations considering blockchain-based procurement or auctions, the protocol provides a practical path to privacy-preserving sealed-bid auctions at scale. The post-auction privacy guarantee (only the winning bid is revealed) is important for competitive procurement where bid amounts are commercially sensitive.

For security practitioners evaluating blockchain systems, the key insight is that the security model assumes the underlying blockchain is secure. Any consensus-level attack (51% attack, 26% attack) would undermine the protocol's guarantees. The hub also represents a centralized trust point, although economic incentives make misbehavior irrational.

Key Takeaways

• Current on-chain sealed-bid auctions hit Ethereum's gas limit at roughly 20 bidders; this protocol scales to 1,000+
• Constant on-chain cost when all parties are honest; O(K) cost for K misbehaving bidders
• 50x gas cost improvement over the state-of-the-art RCTC protocol
• Post-auction privacy ensures only the winning bid is revealed; all other bids remain hidden
• Financial fairness through collateral slashing makes misbehavior economically irrational
• The key architectural insight: combining off-chain execution (PPCs), zero-knowledge proofs (zk-SNARKs), and on-chain dispute resolution outperforms heavy on-chain cryptography
• Future work targets multi-item auctions and alternative zk-SNARK schemes

About the Speaker(s)

Mohsen Minaei (presented by Duke) is a researcher at Visa Research. The work is a collaboration between Visa Research, IMDA, Georgia Tech, and MIT. The team has prior work on Programmable Payment Channels (ACNS 2024) and brings together expertise in blockchain protocols, zero-knowledge cryptography, and applied cryptographic engineering.