Encrypted メンプール & Order Flow Privacy

MEV 防御ランドスケープ — F3B · FHE-MEV · POF/PBS · DFBA · ダークプール

$750M+/yr MEV extracted 5 defense strategies F3B: 0.026% overhead FHE-MEV: not yet practical
$750M
MEV/year
$280M
MEV/month est.
70%+
Top-3 builder share
100ms
DFBA batch window
5
Defense strategies

メンプール MEV 問題

Ethereum's public mempool exposes every pending transaction to the world before it is confirmed. This creates a $750M+/year extraction opportunity for sophisticated actors who can observe, reorder, or insert transactions.

ユーザー submits Tx MEMPOOL Public & unencrypted ↗ frontrunning ↗ sandwich attacks ブロック ビルダー orders & bundles Txs MEV extraction here ブロック finalized チェーン immutable MEV bots observe here ⚠ MEV extraction hotspot Pre-confirmation Post-confirmation
Standard Ethereum transaction lifecycle — mempool is fully public and unencrypted, creating the primary MEV extraction surface

MEV タイプ: 有害・中立・好ましい

有害な MEV

フロントラン サンドイッチ攻撃

フロントラン: MEV bot sees pending swap, submits identical Tx with higher gas — executes first, harms user price.

サンドイッチ攻撃: Bot frontruns user swap (price moves against user), then backtuns (captures profit). User gets worse execution.

中立/好ましい MEV

バックラン 清算 Arbitrage

バックラン: Follow a Tx to arbitrage resulting price discrepancy across DEXs. Restores price efficiency.

清算: Closing under-collateralized DeFi positions. Required for protocol health — competitive but necessary.

5 つの MEV 防御戦略

戦略メカニズムステータス防止対象
メンプール暗号化 (F3B) 最終化まで閾値 BLS 暗号化 Practical Frontrun, sandwich
FHE ブラインド計算 暗号文で計算 — ユーザー Tx を復号化しない まだ実用的ではない Frontrun, sandwich
ダークプール (Renegade) P2P MPC ベースのマッチング、パブリック メンプールなし テストネット All orderflow MEV
バッチオークション (DFBA) 100ms バッチ — 到着時刻は無価値 設計/PoC Sandwich, frontrun, latency race
OFA/PBS (MEV-Share) ユーザーへの MEV 再配分 本番運用 ユーザー harm (redistributes, doesn't eliminate)
重要知見: 直交する保護

Pre-confirmation privacy (F3B, FHE-MEV) and post-confirmation privacy (Tornado Cash, Privacy Pools) are orthogonal. A complete solution needs both. These papers focus on the mempool/ordering phase.

F3B — Flash Boys バックブロッカー

EPFL 2023 0.026% overhead 今日実用的

Authors: Sousa, Benhamouda, Halevi, Tiwari, Malvai, Shi (EPFL)

Core Idea: Encrypt every transaction until the block it belongs to is finalized. Reveal content only after ordering is immutable — frontrunning becomes impossible because the content is unknown during block construction.

PHASE 1 — Pre-finalization (ordering) PHASE 2 — Post-finalization (execution) ユーザー plaintext Tx Threshold Enc. BLS / Shamir encrypt(Tx, pk) ビルダー sees ciphertext only ビルダー cannot frontrun Content unknown → orders only by fee No content-based advantage possible ブロック finalized with [ciphertexts] ordering immutable — safe to reveal Key Holders threshold validators reveal decryption Tx Revealed plaintext now available Execution as user intended Backrunning/arbitrage still possible Content revealed after finalization — searchers can react, but ordering already locked
F3B two-phase protocol — Phase 1 hides content during ordering; Phase 2 reveals for execution after finalization is immutable

Technical Foundation

Threshold BLS Encryption with Shamir secret sharing. Key holders: a subset of validators. Decryption requires t-of-n validators to cooperate — no single point of failure.

Measured Performance

0.026% latency overhead vs baseline. This is essentially negligible — F3B is among the most practical mempool privacy proposals to date.

What F3B Protects vs Does Not Protect

保護対象

  • フロントラン — content hidden during ordering
  • Sandwich attacks — can't sandwich what you can't see
  • Content-based reordering — builder sees only ciphertexts

NOT 保護対象

  • Statistical inference — patterns from timing/size still leak
  • バックラン after reveal — searchers can react post-finalization
  • Post-confirmation privacy — on-chain data still public forever
  • Validator collusion — if t validators collude, breaks
Key Limitation

F3B encrypts until finalization, then reveals. Any searcher who monitors the chain can still backrun post-reveal. Good MEV (arbitrage, liquidations) is preserved but so is some post-finalization extraction. FHE-MEV takes a fundamentally different approach to eliminate even this.

FHE-MEV — ブラインドアービトラージ

Flashbots / Imperial College London 2023 まだ実用的ではない TFHE / Zama

Author: Jonathan Passerat-Palmbach (Flashbots / Imperial College London)

Core Idea: A searcher executes a backrun on an encrypted user transaction — the user's Tx content is never decrypted, yet the searcher can still extract arbitrage profit. This eliminates even the post-reveal information leakage that F3B allows.

ユーザー UniswapV2 Tx TFHE.encrypt 128-bit uint tfhe-rs (Rust) FHE Computation (on ciphertext — never decrypts) 1. Extract token pair 2. Verify constraints 3. Compute swap amount 4. Check arbitrage opportunity ユーザー Tx content NEVER revealed to searcher Decision if arb opportunity: submit backrun Tx else: pass チェーン backrun settled ⚠ High compute cost "significant runtime constraints"
FHE-MEV blind arbitrage — searcher computes on encrypted Tx content using TFHE, without ever learning the user's transaction details

技術: TFHE (トーラス FHE)

実装

  • Library: Zama's tfhe-rs (Rust)
  • Data type: 128-bit unsigned integers for UniswapV2 reserves
  • Operations: Addition, comparison, multiplication on ciphertexts
  • Security: 128-bit security level

現在の制限事項

  • Compute cost: Very high — admitted in paper as "significant runtime constraints"
  • Bootstrapping: TFHE bootstrapping is expensive per gate
  • Throughput: Cannot match production mempool throughput today
  • Complexity: UniswapV2 is simplest case — V3/other AMMs far harder

3 つの改善パス

パス 1: アルゴリズム FHE 最適化

More efficient FHE schemes, better circuit compilation, reduced bootstrapping frequency. Active research area in cryptography community.

パス 2: FHE ハードウェア アクセラレータ

GPU/ASIC designed specifically for FHE operations. Companies like Intel, Google, and startups actively developing FHE accelerators. 1000x+ potential speedup.

パス 3: 回路最適化

Community-optimized FHE circuits for specific DeFi primitives (AMM swap, lending check). Fewer gates = faster computation.

F3B vs FHE-MEV: 基本的な比較

プロパティF3B (EPFL)FHE-MEV (Flashbots)
Tx content secrecy Hidden until finalization, then revealed for execution Never revealed — computed on ciphertext
Good MEV (backrun) ✓ Survives (after reveal) ✓ Preserved (FHE searcher still backruns)
今日実用的 ✓ 0.026% overhead ✗ High compute cost
フロントラン ✓ Prevented ✓ Prevented
Post-reveal information ✗ Content visible after finalization ✓ Content never visible
Cryptographic basis Threshold BLS, Shamir Torus FHE (TFHE), tfhe-rs
Validator/key holder trust Requires t-of-n validators to cooperate No key holder trust required

プライベートオーダーフロー & PBS

2023 Research 本番運用 MEV-Share Centralization risk

POF = Private Order Flow: Transactions routed directly to block builders with exclusive access deals, bypassing the public mempool.

Public Path ユーザー A retail Public メンプール visible to all bots MEV extraction here Private OFA Path ユーザー B Coinbase/Uniswap OFA / MEV-Share searchers bid on Tx MEV shared back to user ブロック Builders builder0x69 ~35% Flashbots ~25% BloXroute ~15% Others ~25% Validators PBS relay highest bid wins Proposer proposes block to chain チェーン finalized
Order Flow Auction architecture — private OFA paths bypass public mempool but concentrate power in top builders

ビルダー Market Concentration (2023)

Top-3 75% builder0x69 (~35%) Flashbots (~25%) BloXroute (~15%) Others (~25%) Systemic centralization risk POF exclusive deals → few builders dominate → censorship risk
Ethereum block builder market share (mevboost, 2023) — top-3 builders produce 75%+ of all MEV-boost blocks

主要知見: POF × PBS 研究

POF とは

  • Transactions from Coinbase, UniswapX, Metamask Swap etc.
  • Routed directly to preferred builders with exclusive access
  • NOT "private" in cryptographic sense — just non-public mempool
  • Builders with POF deals get first look at high-value flow

集中リスク

  • POF creates moats for large builders
  • Small builders can't compete without exclusive flow access
  • ビルダー concentration → censorship risk
  • "MEV democratization" (Flashbots goal) became "MEV centralization"

重要な緊張: ユーザー利益 vs システミック リスク

POF パラドックス

OFA improves user outcomes — users get MEV rebates, protection from sandwich attacks, better execution. But OFA requires exclusive deals with specific builders, which creates market concentration. The mechanism that protects individual users from MEV may be creating protocol-level systemic risks.

MEV-Share (Flashbots 本番システム)

MEV-Share の動作方法

バッチオークション — DFBA

Jump Crypto / Archer Exchange 2025 設計/PoC stage Eliminates latency arms race

Core Idea: Batch all orders arriving within a 100ms window into a single uniform auction. Within a batch, arrival time has zero value — there is no advantage to arriving 10ms vs 90ms before batch close. This structurally eliminates frontrunning and sandwich attacks.

Batch 1 Orders A, B, C arrive 0ms → 100ms window Batch 2 Orders D, E, F arrive 100ms → 200ms window Batch 3 Orders G, H arrive 200ms → 300ms window Order A 0ms Order B 50ms Order C 90ms BATCH CLOSE 100ms BATCH CLOSE 200ms BATCH CLOSE 300ms A, B, C processed identically — arrival time = 0 value
DFBA 100ms batch windows — orders within a batch are processed uniformly; no advantage to arriving first within the window

メーカー/テイカー分離

メーカー (リミットオーダー)

  • Provide liquidity with price conditions
  • Compete on price quality, not arrival time
  • Within batch: best-priced maker wins
  • No incentive for latency optimization
  • HFT market makers can participate without speed arms race

テイカー (マーケットオーダー)

  • Consume liquidity at clearing price
  • Time-insensitive within the 100ms window
  • All takers in a batch get same clearing price
  • No sandwich attack possible (no ordering within batch)
  • Retail users fully protected from timing attacks

DFBA が排除するもの

問題継続的トレーディングDFBA (100ms バッチ)
Sandwich attacks ✗ Possible — insert between Txs ✓ Impossible — no temporal ordering within batch
フロントラン ✗ Possible — submit same Tx faster ✓ Eliminated — arrival time irrelevant within batch
Latency arms race ✗ Constant pressure — 1ms advantage = profit ✓ Eliminated — 100ms resolution kills HFT timing edge
リアルタイム実行 ✓ Instant settlement ~ 100ms delay per batch
価格発見効率 ✓ Continuous ~ Slightly delayed (100ms granularity)

歴史的背景: 頻繁バッチオークション (FBA)

Budish FBA (QJE 2015)

Eric Budish (Chicago Booth) proposed Frequent Batch Auctions in traditional finance as a remedy for the HFT latency arms race. DFBA adapts this concept to DeFi/on-chain contexts where MEV is the equivalent of HFT predation.

Key parallel: In TradFi, HFT bots race to be first by microseconds. In DeFi, MEV bots race to be first by gas price. Both waste resources on pure latency competition. Batch auctions eliminate this by discretizing time.

トレードオフ: 100ms 遅延

DFBA introduces a 100ms execution delay for all orders. For most DeFi users this is negligible, but it creates challenges for use cases requiring real-time execution (e.g., liquidations in fast-moving markets). Batch size selection is a key design parameter.

包括的な防御比較

Evaluating all five MEV defense strategies across key properties — practicality, protection scope, and systemic implications.

各防御が適用される場合

Tx Submitted FINALIZATION On-Chain Pre-confirmation — MEV hotspot Post-confirmation — analytics risk F3B — encrypts entire pre-confirmation phase FHE-MEV — never decrypts (pre + post leakage blocked) DFBA — batch ordering neutralizes pre-confirmation timing OFA/MEV-Share — redistributes MEV extracted pre-confirmation Tornado Cash / Privacy Pools — post-confirmation sender/receiver privacy
Defense mechanisms mapped to the transaction lifecycle — pre-confirmation and post-confirmation protections are orthogonal and complementary

完全プロパティ マトリックス

戦略 Frontrun Sandwich Backrun Post-confirm privacy Practical now Decentralized Latency impact
F3B (threshold enc.) ✓ Blocked ✓ Blocked ~ Allowed post-reveal ✗ None ✓ 0.026% overhead ✓ Validator threshold Negligible
FHE-MEV (blind arb) ✓ Blocked ✓ Blocked ✓ Preserved (FHE) ✗ None ✗ High compute cost ✓ No key holders Very high (FHE)
ダークプール (Renegade) ✓ Blocked ✓ Blocked ✓ No mempool ~ Partial (MPC) ~ Testnet only ✓ P2P MPC Matching latency
DFBA (batch auction) ✓ Blocked ✓ Blocked ~ Blocked within batch ✗ None ~ 設計/PoC ✓ Protocol-level +100ms delay
OFA/MEV-Share ~ Redistributes ~ Partially mitigated ✓ Rebated to user ✗ None ✓ 本番運用 ✗ Builder centralized Minimal

ユースケース別推奨ガイド

リテール DeFi ユーザー 今日

Use MEV-Share / Flashbots Protect for immediate protection. Rebates for MEV extracted. Available now, no protocol changes needed.

プロトコル デザイナー (L1/L2)

Consider F3B-style threshold encryption for mempool. 0.026% overhead is negligible. Requires validator coordination but highly practical.

DEX デザイナー

DFBA-style batch auctions structurally eliminate sandwich attacks. Good for new DEX designs where 100ms latency is acceptable.

機関 / 大規模トレード

Dark pools (Renegade/Prime Match) for large trades where full orderflow privacy matters. P2P MPC matching, no public mempool.

将来: FHE 成熟

When FHE hardware accelerators (GPU/ASIC) make TFHE practical, FHE-MEV provides the strongest guarantee — content never revealed, ever.

完全なプライバシー スタック

Combine pre-confirmation (F3B or dark pool) + post-confirmation (Privacy Pools / zkSNARK) for full protection across both phases.

実用的準備

OFA / MEV-Share
本番運用 — live today
F3B (EPFL)
Research — 0.026% overhead, ready for deployment
ダークプール (Renegade)
テストネット — active development
DFBA (batch auction)
Design / early POC
FHE-MEV (blind arb)
Research — high compute cost
研究フロンティア (2025+)

The most promising near-term path: F3B deployed at L2 level (encrypts mempool, negligible overhead) + MEV-Share for redistribution (production-ready) + FHE hardware acceleration watch (orders-of-magnitude improvement coming). Long-term, FHE-MEV eliminates the fundamental information asymmetry entirely.


ソース & 主要論文

F3B

Sousa, Benhamouda, Halevi, Tiwari, Malvai, Shi. "Flash Boys Back-Blocker." EPFL, 2023. Threshold BLS encryption for mempool privacy.

FHE-MEV

Passerat-Palmbach. "Blind Arbitrage." Flashbots / Imperial College London, 2023. TFHE-based searcher that operates on encrypted Txs.

POF × PBS

Private Order Flow and PBS centralization analysis. Mevboost builder market study, 2023. OFA concentration dynamics.

DFBA

Dual Flow Batch Auction. Jump Crypto / Archer Exchange, 2025. DeFi adaptation of Budish FBA (QJE 2015).

Budish FBA (foundation)

Budish, Cramton, Shim. "The High-Frequency Trading Arms Race." QJE 2015. Original FBA design for TradFi latency race elimination.

Flash Boys 2.0

Daian et al. "Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges." IEEE S&P 2020. Foundational MEV characterization paper.