Sealed bid auctions for initial offerings

Hi everyone!

Today I’d like to get feedback on some thoughts that I have had in the last few days, after what has happened in the API3 token sale and the talks that have arised since.

In particular, I found interesting the move from Gnosis, labeling GPv1 as not suitable for IDOs and even discouraging new offerings to be held using the protocol itself.

This sparked the will in the community to build an IDO-specific dapp, leveraging easyAuction as the smart contract suite of choice to perform initial token offerings (see here).

I’ve had a look at easyAuction and I have some considerations on it, mainly about its fairness and “frontrunning” resistance. For those that haven’t read how easyAuction works, I suggest having a look here.

Basically speaking, anyone can set up an auction by specifying the amount of tokens to be sold, the amount of value to get back for them (in turn indirectly specifying the lowest possible price for each token) and the auction’s start date and duration.

Once the auction starts, anyone can place public bids that will be kept on-chain, ordered from the highest to the lowest in terms of price.

When the auction ends, in order to determine the clearing price, easyAuction just loops over the previously placed bids, from the highest to the lowest, and stops whenever it reaches a volume which satisfies the auction’s offered token amount.

At this point, the price for the lowest valid bid is taken and applied to all of the higher bids, so that all of the successful bidders end up paying the clearing price.

The interest of every investor participating in the auction is, generally speaking, not only to get the lowest possible price they’re willing to pay for each token they are buying, but to get the most bang for the buck. Higher bids are almost surely getting into the sale at the same price as the clearing price, but will most likely get less tokens related to bids closer to the clearing price itself, because more value has to be locked to confirm them.

If the orders are public (like in easyAuction, where they are encoded on-chain but easily analyzable and decodable by anyone), the bidders have all the information that is needed in order to place the best orders possible. They know when the auction ends, they know the volume for each bidded price etc.

Let’s make a practical example to see where the problem could lie:

Let’s image an initial offering of 10k TKN that are sold to raise at least 100k USDT. The minimum price that each token must have to reach the target is 100k USDT / 10k TKN = 10 USDT, so any bid below this threshold would just not be considered as valid. The auction lasts 5 minutes.

  • Minute 1: a bidder comes in and is willing to pay 15 USDT per token to buy up 5k TKN, which would theoretically result in a net expense of 75k USDT.
  • Minute 2: another bidder comes in and is willing to buy 2k TKN paying 12 USDT per token, with a theoretical expense of 24k USDT.
  • Minute 3: a third bidder comes in and buys up the remaining 3k TKN for a price of 10 USDT per token, with a projected expense of 30k USDT.

At this point in time, any informed bidder can see that the clearing price has been reached and is 10 USDT. As long as the third bidder does not cancel their order, the only way to enter the sale right now is to place a bid higher than the one at 10 USD, for the same amount of tokens or less. In a way, any bidder would be incentivized to bid at the last second, at a just a fraction more price for the same volume (as long as the price they’d have to pay is low enough for them), to get the clearing order.

So a bidder could place a bid for 3k TKN at a price of 10.01 USDT per token, another one at a price of 10.1 USDT per token, and so on and so forth, all at the last second.

This should in general be good for the auctioneer, and an expected behavior in a “normal” auction, because an increased clearing price means more raised funds given the same sold volume, but not extremely fair or optimal in general, because at the end of the day, the one bidder that bids at the last second theoretically has all the information to place an order that will almost surely get filled and either determine the clearing price, or be very close to it as long as the current clearing price is low enough for him to slightly increase it in a subsequent order.

This happens even if the original idea for the bidder was to bid higher after the research they’ve done on the project at hand. Maybe a fourth bidder would have been more than willing to come in and buy up 3k TKN at 11.5 USDT, but why would they do it if they can just wait until the last second, see what price they’d need to pay to get into the sale and just pay it as long as it is less or equal than their original estimate?
It has to be said that there’s a risk in doing this, which is to not get the amount of tokens they initially wanted to buy up, but potentially less (because in the meantime other bidders could have placed higher bids for lower volumes than 3k TKN, not clearing up all the sold volume, and leaving just a fraction of it left in the sale.

I can see a kind of a more general “problem” here, and that is that the more information is available, the more these kinds of games can be played, unhealthy competition is sparked, and less focus is put on “healthy” price discovery, while more on how to “trick” the system.

In a way, we can consider this a kind of frontrunning on auctions. Quoting from this article:

Frontrunning is a form of information theft. It weakens the market’s competitive edge by decreasing the incentive to collect original information and base one’s trades on it—it depresses mass adoption by promoting unfair pricing mechanisms.

Which I think kinda summarizes the scenario.

So I thought about how to try and fix this (and by this, I mean the exploitation of market information to get an unfair advantage over other investors, mainly retail).

I reached the conclusion that sealed bid auctions might be a good solution, and could be implemented using some sort of commit/reveal scheme.

The general idea is to have a sort of commit/reveal scheme where bidders commit to buy a certain volume of token at a certain price, but the only public and visible thing in this whole process is the fact that the bidders transfers the amount of tokens they’d use to perform the buy to the auction contract. The amount that they want to get back in exchange for that (which in turns defines the price) is kept secret, and passed in as an opaque value (for example it might be the hash of the actual value plus a message signed by the user to increase entropy and avoid attacks trying to find out the final value).

All of the commitments would be taken in in the first phase of the auction, on which it is possible to place sealed bids. Once the first phase ends, the second one starts, in which every bidder has to fully reveal their original bid. They call a function giving in the amount they wanted to buy and the private, signed message used in the previous step to commit, and a hash of the two values is calculated on-chain. If the calculated value matches with the one that was previously given, the order is indeed confirmed. In this scenario, order checks on prices etc would be done right now, so any order below the minimum price could just be ignored for example.

This second phase, just like the first one, would have a time limit, at the end of which the orders would be public, transparent, and guaranteed to be genuine by cryptography.

At this point the clearing price determination algorithm can just be run.

There’s the risk that for whatever reason a bidder that had previously committed to a certain price might not want to reveal it after seeing the other bidders’ votes revealed, but at that point he could simply get slashed, because of the amount that he locked in in the first phase (the auction contract still has it as a “hostage”, so things could be done).

My hope is that an auction where bidders cannot be influenced by other bids due to lack of information would bring the bidders themselves to a deeper research on the project/market at hand, and in turn in “better-placed” bids (that hopefully translate in a healthier price discovery and determination altogether).

This is the basic idea. I’d really like to get some feedback by people that know a lot more than me about this, because it’s like the first time that I’ve really thought about these things. Hope this can be helpful or even just spark a good discussion!


If your analyses is true, and easyAuction is front-runable as you say, this renders it pretty useless. We should ask josojo about this.

Commit/reveal scheme may be a way to explorer, but sounds complicated.

I also think that IDO should be transparent, so that people understand how the price was achieved. We will try to strengthen this transparency but with commit/reveal this may be difficult?

Cryptographically it will be provable, but front running may be achieved socially with people talking bids in the background. (But this can happen to every auction)

Bouncer has something call sealed bid auction, and Aluna IDO is not only running on Mesa, but simultaneously on bouncer:

My point is we should, on the long run, tried to have different IDO mechanisms because projects, tokens and communities are different. They should be as fair as possible, but even fairness is not from every standpoint the same.

I good starting point for more research would be to make a sheet and compare different existing auction mechanisms and their properties.


This is exactly why I wanted feedback by way more expert people. I didn’t really know about Bounce finance’s existence up until today. What they are doing seems exactly to be what I had in mind (that is, running initial offerings through sealed bid auctions, among other mechanism they offer).

Weird thing though: after a quick look into the project I couldn’t find any reference to how they’ve implemented on-chain, transparent sealed bid auctions, and I couldn’t find links to the code or the smart contracts they use on-chain to run them either. If that is not open source, public and auditable, the transparency of the process is not there, at least IMHO, so it might make sense to explore the proposed commit/reveal approach further and maybe build a proof of concept dapp to show how it could be done?
We could be the first on the market to offer a transparent, 100% on-chain and decentralized way to hold sealed-bid auctions (unless other solutions already exist that I’m not aware of).

I also think that IDO should be transparent, so that people understand how the price was achieved. We will try to strengthen this transparency but with commit/reveal this may be difficult?

The commit/reveal approach should be 100% transparent, and if we have open source, verifiable code for the smart contract that runs on-chain and that collects sealed bids, verifies them on reveal and calculates the clearing price accordingly, bidders will have the 1000% guarantee that everything is done according to plan.
The only non-transparent thing in this process is the bid, but that’s by design since sealed bids auctions are there to hide bids from other interested bidders in order not to influence them.

My point is we should, on the long run, tried to have different IDO mechanisms because projects, tokens and communities are different. They should be as fair as possible, but even fairness is not from every standpoint the same.

This sounds extremely good! And I think having sealed bid auctions as an initial offering method would be an amazing addition!
Actually, another thing: I’ve noticed that Bounce uses sealed bid auctions to auction off NFTs too, which might be super interesting and relatively easy to implement given the hot topic at hand.

I good starting point for more research would be to make a sheet and compare different existing auction mechanisms and their properties.

Agreed. If you guys want I can definitely try to help as best as I can.

Hey @luzzifoss thanks for the proposal!
I think that there are two key factors for every sale participant:

  1. The dollar amount the he’d like to invest
  2. The maximum price he’s willing to buy at

If those are determined, every participant should just submit his bid early and wait for the results.
Participants know they are guaranteed to participate at their max price or less, and with their max amount.
Obviously if the predicted clearing price is just above your max you might be willing to raise your bid a bit and that might indeed happen.
In a market where tokens are being sold without sufficient substance to the token value and people’s behavior tend to be irrational, this might happen a little more.
But rational participates should just bid early with their max amount and price.

Sealed bid auctions are also known and used for many years for price discovery.
The add the complexity of two stage process IMO is a real added friction.
Participants will need to time their participation twice in order to secure their allocation.
It will also probably will consume more gas which has two downsides:

  1. Cost of participation is higher thus minimum participation amount is higher
  2. Less bids could be fitted into a single block which means less participants are allowed into the sale, thus reducing fairness and broad distribution. (not entirely sure about that point - would be happy to be proved wrong)

Additionally, I think slashing for participants who didn’t reveal is really not fair and will deter people from participating. But if you don’t punish this behavior, it becomes problematic.

If we had enough resources, I think it’d be really interesting to implement both and let auctioneers choose.
Given resources are always limited, I think we should start with the simpler approach of easyAuction

1 Like

Another thought, maybe we can design it such that easyAuction is extendable in case we want to add sealed bids in the future

1 Like

I did think about the bid-wars at the end around easyAction, and came up with an idea how to make this more fair, see more here:

1 Like

Researching auction types I found this sealed-bid auction:

And a story about the google IPO, which used a similar auction then we are going to implement for mesa: