Conclusions and Future Work

This chapter closes the work: it synthesises the results and answers the research questions (§6.1), acknowledges the limitations (§6.2), consolidates the directions for future work (§6.3) and ends with the final considerations (§6.4).

6.1 Synthesis and answers to the research questions

The two research questions formulated in §1.3 can now be answered. The primary one asked whether it is possible to run a Vickrey auction on a public blockchain without leaking any bid beyond the closing price, preserving the truthfulness property; the secondary one, at what operational cost such an execution is viable. That the FHE pattern enables this kind of auction had already been demonstrated in the Zama lineage, as discussed in Chapter 3; what this work adds is a rigorous answer on a different platform: the realisation of the mechanism over Fhenix CoFHE, with its distinct decryption model, accompanied by a quantitative characterisation of the cost and of the residual leakage. To the primary question, the answer is affirmative; to the secondary one, the gas and latency costs measured in Chapter 5 show that the execution is viable at the scale of small to medium institutional auctions.

To reach that answer, the six specific objectives stated in §1.5.2 were fulfilled. The problem of information leakage in native public-blockchain auctions, and the limits of the existing approaches to mitigating it, were characterised in the introduction and in the chapters on related work and development (objective 1). The ConfidentialVickreyAuction contract, which solves the exclusion problem and the deterministic handling of ties over the primitives of Fhenix's FHE.sol, was implemented and described in Chapter 4 (objective 2). The web interface, with encryption performed in the user's own browser via WebAssembly, was built and integrated into the auction flow (objective 3). The end-to-end deployment was carried out on the public testnet Arbitrum Sepolia, with Fhenix CoFHE active, and the correctness of the mechanism was validated by real auctions run through the graphical interface from the minimum number of bidders required by the contract upwards, in addition to a suite of twenty tests (objective 4). The implementation was evaluated empirically along the axes of computational cost, latency and information leakage, in populations of three, five and ten participants (objective 5). And the trade-offs, limitations and threats to validity were discussed in Chapter 5, with the directions of extension consolidated in this chapter (objective 6).

With the objectives fulfilled, hypothesis H formulated in §1.4 is confirmed in its three parts. As to secrecy (part a), the leakage analysis of Chapter 5 showed that the only bid value revealed by the mechanism is the second-highest price, alongside the identity of the winner required by the delivery of the item; all losing bids remain permanently encrypted, and even the winner's bid is only partially revealed, confined to the interval between the second price and the collateral. As to truthfulness (part b), it is preserved, for participants whose true value does not exceed the public collateral required (§5.6), precisely because the bids remain effectively sealed throughout the contest, a condition on which the dominant strategy of revealing the true value depends. And as to practical viability (part c), the auction was executed on a public testnet at the scale of up to ten participants, under measured and documented gas and latency costs.

Those costs, which answer the secondary question, can be summarised. The bid operation is the most expensive in the mechanism, at around 611 thousand gas units on the testnet on average, since it concentrates the homomorphic arithmetic of the cap and of the update to the pair of highest bids; the other operations cost significantly less. The cost per operation is constant in the number of participants, a property that follows from the incremental top-2 pattern and was confirmed in the measurements in the simulated environment (mock); the total cost of an auction grows approximately linearly, from around 2.7 million gas units for three participants to around 8.3 million for ten, simply because there are more bid and withdrawal transactions. In latency, the dominant component perceived by the user is not the on-chain confirmation, but client-side encryption, on the order of seven seconds, inherent to the cost of TFHE; the query to the distributed decryption network costs around three additional seconds in the reveal phase.

In summary, the work delivers three articulated contributions. The first is the implementation itself of the confidential Vickrey auction over Fhenix CoFHE, with the exclusion problem and the handling of ties solved by an incremental top-2 pattern of constant cost. The second is the formal analysis of information leakage under an explicit adversary model, accompanied by a closed-form measure of the residual uncertainty about the bids. The third is the end-to-end validation on a public testnet, with a reproducible graphical interface and client-side encryption, which demonstrates the viability of the mechanism outside the controlled environment of simulation.

6.2 Limitations

The limitations of the work were discussed in detail in Chapter 5 and are only recapitulated here. The evaluation covered populations of up to ten participants, consistent with the hypothesis of small to medium institutional auctions, but not large-scale auctions. The implementation addresses the single-unit case, not the simultaneous allocation of multiple units. The gas figures of the mock environment and of the testnet differ by construction, so that only the testnet values represent production cost. The identity of the participants and the public cap imposed by the collateral remain visible, as acknowledged in the threat model. And the evaluation took place on a single on-chain FHE platform, which limits direct generalisation to other infrastructures. None of these limitations invalidates the answers to the research questions; all of them, however, delimit their reach and motivate the extensions that follow.

6.3 Future work

The results of this work open up seven directions of extension.

The first is the generalisation to multi-unit auctions, in which several units of an asset are offered simultaneously and allocated to the highest bids at the price of the first losing bid. That extension is particularly pertinent to the RWA use case that motivated the work, in which the primary allocation of fractional tokens is naturally multi-unit, and it requires generalising the top-2 pattern to the homomorphic maintenance of the top-k bids.

The second is the controlled empirical comparison with baselines. A natural extension of this work is to measure, under the same methodology, the FHE implementation side by side with a commit-reveal auction and a plaintext auction. That would make it possible to quantify precisely the "price of privacy", that is, how much additional gas and latency confidentiality costs relative to the alternatives, converting into measurement what this work discussed qualitatively.

The third is scalability. Since the total cost grows linearly with the number of participants, auctions with hundreds of competitors would demand investigation of optimisations, such as batching homomorphic operations and reducing the number of comparisons per bid, as well as evaluation on networks with lower gas cost.

The fourth is concealing the identity of the winner. The mechanism today reveals, out of the need to deliver the item, who won. Stealth address techniques, in which the item is allocated to a derived address not directly linkable to the winner, would allow the leakage to be narrowed further, as anticipated in §4.1.6.

The fifth is the application of the architectural pattern to other auction mechanisms. The topology of encrypted state plus client-orchestrated selective revelation is not specific to Vickrey; it could instantiate Dutch, English or double auctions, described in the typology of §2.5.1, each with its own set of values to reveal at the end.

The sixth is the relaxation of the minimum number of participants. The contract requires at least three bidders so that the second price does not trivially coincide with the highest bid. Alternative tie-breaking mechanisms, or encrypted reserve-price schemes, would allow the mechanism to be extended to auctions with fewer participants without compromising secrecy, as pointed out in §4.2.5.

The seventh is the redesign of the collateral model. Full collateral in native ETH locks up capital and exposes participants to the asset's volatility. Two directions deserve investigation: the use of stablecoins (tokens whose value is pegged to a fiat currency) as the collateral asset, more aligned with the practice of institutional markets and with the RWA use case; and partial or dynamic collateral schemes, whose central challenge is to preserve secrecy, since any deposit proportional to the bid leaks information about it. Directions such as encrypted-value tokens, in line with confidential token patterns, would be the natural path for reconciling capital efficiency and privacy.

6.4 Final considerations

The motivation of this work started from a concrete tension: auctions on a public blockchain leak, in their native format, all of the participants' strategic information, which inhibits precisely those players whose participation would bring liquidity and price fairness to markets such as that of "tokenised" real-world assets. The usual mitigations, from commit-reveal to private mempools, attack the symptom without eliminating the cause. Fully Homomorphic Encryption, by allowing computation over encrypted bids without ever decrypting them, offers an answer of a different nature, one that attacks the cause.

What this work has demonstrated is that this answer has ceased to be merely theoretical. A Vickrey auction sealed end to end, with truthfulness preserved and without a trusted auctioneer, is today executable on a public blockchain, at a cost that, although expected to be higher than that of a plaintext auction (a qualitative order-of-magnitude comparison, cf. §5.6), is compatible with the auctions of high unit value that benefit most from confidentiality. The cryptographic basis that makes this possible is, moreover, resistant to known quantum attacks, which gives the secrecy of the bids a durability that classical constructions do not offer. As on-chain FHE infrastructure matures and its costs fall, the set of market mechanisms that can migrate to this regime of verifiable confidentiality is expected to widen, and this work offers, for the case of the Vickrey auction, a concrete and reproducible demonstration that the path is viable.