EIP-8184 · Encrypted Mempool

Encrypted mempool.
Same-slot execution.

LUCID encrypts Ethereum's mempool. Same-slot LUCID lets builders decrypt and include protected transactions in the same slot — no extra latency, no compromises.

The same-slot flow
🔒
User
Encrypt & submit
User encrypts tx as a sealed transaction (ST), sets key_publisher to the same-slot key publisher committee
📡
Network
Propagation
ST propagates via FOCIL inclusion lists — or directly to builders for latency-sensitive transactions.†
🤝
Builder
Commit + pay *
Signs slashable commitment: "I will include STs [x,y,z] at top-of-block." Sends payment to key publisher committee.
🔑
Key publishers
Release keys *
Validate commitment + payment. Release decryption keys to builder and broadcast publicly.
Builder
Decrypt & include
Decrypts STs, inserts at top-of-block, builds ABB. Proposer publishes beacon block.

Fallback. If the builder doesn't commit or keys arrive late, standard N+1 decryption applies.

* Steps 3 and 4 happen out-of-protocol. The commitment layer operates before the ABB, breaking the builder/key-publisher circular dependency. Enforcement is hybrid: slashable commitments + FOCIL as the in-protocol backstop.

Direct builder submission. Latency-sensitive STs can go straight to builders — still encrypted, so contents stay hidden until commit. Direct-to-builder for speed, FOCIL for the CR guarantee.

Why same-slot

LUCID's baseline decrypts in slot N+1 — one full slot after submission. That's safe, but for mev-sensitive transactions, an extra slot isn't a fallback. It's the problem.

N+1 decryption (baseline)
  • 24-second confirmation for worst-case mev-sensitive tx
  • Builder is blind at build time — suboptimal block quality
  • State conflicts cascade across slots
  • Intra-slot window compresses under 6s slots
  • Key release is voluntary — no enforcement
Same-slot execution
  • Same-slot confirmation — 12s, not 24s
  • Builder sees plaintext before building — optimal blocks
  • Per-transaction fallback, not whole-block
  • Commitment window decoupled from slot time
  • Slashable commitments + FOCIL backstop

DEX swaps

Price moves in 12 seconds. An extra slot means worse execution or failed trades. Same-slot keeps swaps competitive.

💧

Liquidations

DeFi liquidations are time-critical. Waiting a slot means the position moves, the collateral shifts, the opportunity changes.

📊

Oracle-sensitive trades

Trades conditioned on oracle updates need the current slot's state. N+1 means acting on stale information.

🔮

6s slots and beyond

As Ethereum moves to shorter slots, intra-slot windows compress. Designs tied to slot timing break. Same-slot LUCID doesn't.

How it works

A pre-ABB economic commitment breaks the circular dependency between builder and key publishers — without touching LUCID's core encryption, inclusion, or mev protection guarantees.

1

User encrypts and submits a sealed transaction in-protocol

The user encrypts their transaction as a sealed transaction (ST) and sets key_publisher to the same-slot key publisher committee — this is the opt-in for same-slot execution. The ST is broadcast to the LUCID mempool. Contents are hidden from all parties.

2

ST propagates to builders in-protocol

The ST propagates via FOCIL inclusion lists for censorship resistance. For latency-sensitive transactions, users can also send STs directly to builders — the ST is still encrypted, so builders cannot inspect contents before committing. Both paths can be used simultaneously: direct-to-builder for speed, FOCIL for the CR guarantee.

3

Builder signs economic commitment + payment out-of-protocol

The builder identifies same-slot-opted STs (by key_publisher address) and signs a slashable commitment: "I will include STs [x, y, z] at top-of-block." This commitment is accompanied by a payment to the key publisher committee. Block builders commit in parallel — this is leaderless, with no need to know the auction winner. Participation is optional; builders who don't commit simply build N+1 blocks as usual.

4

Key publishers validate and release decryption keys out-of-protocol

The key publisher committee validates the commitment and payment, then releases decryption keys to the builder and broadcasts publicly. Keys are tiny (48 bytes) — they propagate across the network in ~200-500ms, arriving at attester nodes before the block does.

5

Builder decrypts and builds the optimal block in-protocol

With plaintext access, the builder decrypts STs, inserts them at top-of-block, recomputes the state root, and constructs the Auditable Builder Bid (ABB) covering the complete payload. Full information means optimal block composition — back-running enabled as a price-discovery channel.

6

Block published — consensus sees a normal LUCID block in-protocol

The proposer selects the ABB and publishes the beacon block. From the consensus layer's perspective: a normal LUCID block. The only spec change: decrypted_transactions can now carry same-slot STs when the builder demonstrates key availability before ABB construction.

Leaderless conditional commitments
Builder A
commits → gets keys → builds
loses auction → no-op
Builder B ✦
commits → gets keys → builds
wins auction → block settles
Builder C
commits → gets keys → builds
loses auction → no-op

Block builders commit in parallel. No need to know the winner. Compatible with ePBS where the winner is unknown pre-beacon block. Non-winners hold plaintext for transactions already ordered and finalized — no residual advantage.

Why key publishers release keys reliably
Builder
Pays for early key access
Full plaintext → better block composition → wins auction more often
Key Publisher Committee
Releases keys to committed builders
Compensated per release — payment is the signal

In same-slot LUCID, builders bear the cost of key access — not users. The builder pays because plaintext visibility is competitively valuable. LUCID's base spec includes a small user-paid key_publication_fee for key publisher uptime, but when users opt into same-slot execution, the builder's payment is the primary revenue signal and may fully subsidize the user's fee.

Key properties

Three things that make same-slot LUCID work where other approaches don't.

🏗️

Leaderless

Block builders commit in parallel — participation is optional. Compatible with ePBS where the winner is unknown pre-beacon block. No single builder is the bottleneck.

⏱️

Slot-time agnostic

The commitment window lives outside the consensus path. Same design at 12s, 6s, 3s — doesn't degrade as slot times compress.

💰

Incentive-complete

Builders pay for keys because it's profitable. Key publishers release because they're compensated. mev protection preserved via slashable commitments + FOCIL.

🆓

Zero user fee

Builders bear the cost of key access — not users. The builder pays because plaintext visibility is competitively valuable. Users can set key_publication_fee = 0 for same-slot execution since the builder's payment subsidizes key publisher operations.

Slot-time independence
12s
Current slots
✓ works
6s
Proposed
✓ works
3s
Future
✓ works

As Ethereum's slot times compress, this property becomes increasingly load-bearing.

mev protection is preserved. Toxic mev (frontrunning, sandwiching) remains fully prevented — the builder cannot see plaintext before committing. Back-running is preserved and improved: builders get plaintext at build time for more accurate back-run placement. Identical guarantees to N+1, with lower latency.

Timing analysis

Keys are 2,300× smaller than a block. They arrive at attester nodes before the block does.

WhatSizePropagation
Decryption key (assembled)48 bytes~200-500ms
Full key publisher shares (100 key publishers)4.8 KB~200-500ms
Typical Ethereum block~110 KB1-3s (98% under 4s)
Block with blobs~400 KB97% under 4s
Max blobs per block (Pectra)~1,152 KB97.1% sub-4s
12-second slot timeline
t=0s Slot starts. Builder signs commitment.
t=0.5-1s Key publishers release keys (48 bytes, ~200-500ms gossip)
t=1-2s Builder decrypts, inserts ToB, recomputes state root
t=2-2.5s Block published. Keys already at most nodes.
t=2.5-3.5s Block propagates (1-3s typical)
t=4s Attestation deadline. Keys arrived ~2s ago. ✓

Who this matters to

Same-slot encrypted execution touches every layer of the mev supply chain.

🔍

Searchers

Back-running as a legitimate price-discovery channel. Strategies execute in the same slot, not delayed by one. Better execution quality, same mev protection for users.

🧩

Solvers

Full state visibility before building solutions. No blind ordering means fewer reverts, better routing, tighter spreads for intent-based protocols.

🏗️

Block builders

Build with plaintext, not blind. Optimal block construction. Conditional commitments mean you only pay when you win. The economics work in your favor.

🔬

Protocol researchers

A same-slot path that's slot-time agnostic, ePBS-compatible, and incentive-complete. One minimal spec change to LUCID's decrypted_transactions.

Status

Same-slot execution is part of the LUCID encrypted mempool initiative.

✓ Complete

Proposal published

Full specification on ethresear.ch with timing analysis, game theory, and LUCID compatibility.

✓ Complete

Ecosystem alignment

Accepted at Encrypt The Mempool #3 as a candidate same-slot path. LUCID authors aligned on direction.

→ In progress

Execution quality session

Joint working session with the encrypted mempool community to finalize the path forward.

Proof of concept: A related implementation is deployed on Hoodi testnet using Shutter's threshold encryption (3-of-5 key publishers) and staked builder commitments. github.com/shutter-network/primev-sequencer →