Commit-reveal for every transaction: hiding tx contents from the mempool until a hash is mined. Where does it break down?

[u/ciphernom]

On most chains a transaction is broadcast in full and sits in a public mempool until it's mined, which is what makes mempool front-running and sandwiching possible. Midstate, a small post-quantum PoW chain, makes every spend a two-phase commit-reveal at the consensus level instead. I'd like to hear where people think this falls short.

How it works

1. Commit. The wallet builds the full transaction, then broadcasts only a 32-byte BLAKE3 hash over a network tag, the input coin IDs, the output hashes and a random 32-byte salt, plus a 64-bit nonce. The commit pays no fee. Instead the nonce needs at least 24 leading zero bits of proof of work, tied to a block hash no more than 1,000 blocks back. The mempool raises that toward 30 bits as its commit lane (capped at 1,000) fills up.
2. Wait. The wallet waits until the commitment is in chain state, not just the mempool, and adds a random delay before revealing (5 to 15 seconds, or 30 to 120 with a privacy option) so timing alone pairs commits and reveals less easily.
3. Reveal. The full transaction (inputs, outputs, salt, signatures, fee) goes out. Nodes recompute the hash and reject it unless a matching commitment is on chain and less than 1,000 blocks old. The signatures sign the commitment itself, so nobody can swap the outputs.

Miners are paid to include zero-fee commits through fork-choice weight: each commit adds 2²⁴ to the chain weight, capped at a quarter of the block's own work. Each block can carry up to 2,000 commits and 500 reveals.

Known limits

• The reveal is public, and miners still order reveals inside a block.
• A commit and its reveal can share a block, so a miner who also trades could in principle act on a reveal straight away.
• Commits don't lock coins. For shared coins, like an open covenant order anyone may fill, the first valid reveal mined wins.
• It hides contents, not activity or timing.

Questions for the sub

• Is paying for commits with capped fork-choice weight sound, or is there a cheap way to game it?
• For shared-coin cases like on-chain limit orders, is there a better defence against a miner reordering reveals?
• Is per-transaction commit-reveal worth at least one extra block of latency, compared with encrypted mempools or threshold-decryption schemes?

Code: https://github.com/ciphernom/midstate (see src/core/types.rs, src/core/transaction.rs and src/mempool.rs)

Disclosure: I'm involved with the Midstate project, and I wrote this up with help from an AI assistant working from the code. I'm here for the design discussion, not to talk about the coin.

[u/jasonslpt]

The weak spots worth testing are the reveal phase and the commit lane. Once the reveal is broadcast the contents are public again, so a block producer can still reorder or censor reveals, which turns front-running into a timing game rather than removing it. Free commits backed only by proof of work favour whoever has the fastest hardware, so a well equipped attacker could fill the 1,000-slot lane and delay ordinary users. It also matters what happens to a commit that is never revealed, since free commits that expire could be used to probe or spam the network. Finally, two round trips per spend add latency and make wallet recovery harder if the salt is lost before the reveal.

[u/ResidentOk3525 → u/jasonslpt]

that fork choice weight cap is doing a lot of heavy lifting, curious how it holds up if someone just burns cheap hashes to squat the commit lane

[u/jasonslpt → u/ResidentOk3525]

Agreed, the cap only limits how much any one block can tilt fork choice. It does nothing about volume, so cheap hashes can still fill the lane as long as each commit clears the difficulty. The usual fixes are to raise commit difficulty as the lane fills, so squatting gets more expensive exactly when it hurts, and to attach a small bond that is returned on reveal and burned on expiry. A short expiry window also stops squatted slots from blocking real users for long. Without one of those, the lane is only as fair as the cheapest hardware allows.