Introduction

This chapter situates the reader in the context of the work and in the problem that motivates it. It presents the contextualisation (§1.1) and the motivation in five steps (§1.2), formulates the research problem (§1.3) and the hypothesis (§1.4), states the objectives (§1.5), delimits the scope (§1.6), lists the contributions (§1.7) and closes with the structure of the remaining text (§1.8).

1.1 Contextualisation

A blockchain is a public ledger of transactions organised into blocks (batches of transactions ordered and collectively validated by the network) that are cryptographically chained together and kept in sync by participants who do not trust one another. Public blockchains such as Ethereum operate under a principle of transparency built into the protocol: every transaction submitted to the network becomes visible in a public waiting area called the mempool, through which every transaction passes before being confirmed and included in a future block, and the complete history remains recorded in an immutable and auditable form after confirmation. This transparency is what makes trust possible in an environment without intermediaries, but it conflicts directly with entire classes of applications that depend on secrecy during execution. Sealed-bid auctions, voting, market orders and confidential allocation processes are canonical examples of that tension.

Sealed-bid auctions illustrate the tension well. In the mechanism proposed by Vickrey (1961), known as the sealed-bid second-price auction, each participant submits a single bid and the winner (the one who offered the highest amount) pays the value of the second-highest bid. Under that rule, the dominant strategy of every rational player is to reveal their true value. This property, called truthfulness or incentive compatibility (the rule of the mechanism whereby bidding exactly what the item is worth to oneself is the best possible strategy, regardless of how everyone else behaves), is the reason the Vickrey auction is central to mechanism design theory.

The property, however, depends critically on the bids in fact remaining sealed until closing. It is that dependency which makes the Vickrey auction the mechanism chosen by this work: because its main virtue, truthfulness, is tied to the secrecy of the bids, it is at once the most relevant case and the one most sensitive to exposure.

On a native public blockchain the opposite occurs: every submitted bid becomes immediately readable in the mempool, exposed to copy-trading (tactical imitation of someone else's bid before confirmation), to frontrunning (a strategy in which an observer inserts their own transaction immediately ahead of another one they have just seen in the mempool) on the part of validators, and to automated bots that monitor the network in search of profit opportunities. This set of practices is documented in the literature under the term Maximal Extractable Value (MEV), understood as the value that block producers and bots manage to extract by manipulating the order or the content of the transactions they process, as reported by Daian et al. (2020).

The classic answer to this problem in smart contract engineering (programs stored on the blockchain that execute exactly as coded, with no human intervention possible after deployment) is the commit-reveal scheme, in which each participant submits, in a first transaction, only a hash of the bid¹, and reveals the value in plaintext in a second transaction after the commitment deadline.

Although useful as a stopgap, the scheme has structural limitations: it requires two transactions per participant; it exposes the losing bids at the end of the process; it is vulnerable to non-revelation attacks; and it does not naturally preserve the truthfulness property when applied to the Vickrey auction.

A distinct alternative emerges with the maturing of Fully Homomorphic Encryption (FHE), a class of cryptographic schemes that allows additions, comparisons and selections to be carried out directly over encrypted data, without ever decrypting it, so that the result of a computation over ciphertexts, when finally decrypted, is identical to the result of the same computation performed over the plaintexts. Originally formulated by Gentry (2009) as a theoretical construction and turned into practicable variants over the past decade, FHE reaches smart contracts through platforms such as the fhEVM from Zama (2024) and, more recently, Fhenix CoFHE (FHENIX, 2026a), adopted in this work. These platforms offer encrypted types and homomorphic operations (arithmetic and comparison operations performed directly on the encrypted data, without decrypting it) to contracts written in Solidity², allowing a contract to receive encrypted bids, compute the winner and the second-highest value without decrypting the individual bids, and reveal only the strict minimum at the end.

This meeting point between public blockchain, advanced cryptography and mechanism theory defines the object of this work. To make the problem concrete, the work adopts as an application example the primary allocation of tokens representing Real-World Assets (RWA), a category that includes assets from the physical or traditional financial world represented as tradable tokens on a blockchain, such as commercial receivables, fractions of real estate, royalties and credit instruments. In this context, institutional buyers tend to hesitate to take part in public auctions for fear of revealing their price curves to competitors. Although the example is useful for anchoring the discussion, the problem investigated is generic and applies to any sealed-bid auction executed on a public blockchain.

1.2 Motivation

This section details the problem in five steps: (i) the forced transparency of public blockchains; (ii) the economy that forms on top of that transparency; (iii) the dominant stopgap (commit-reveal) and its limits; (iv) the chosen application case (Real-World Assets); (v) what Fully Homomorphic Encryption offers that the previous alternatives do not.

1.2.1 Information leakage in native auctions

On a public blockchain, every transaction goes through three observable stages, detailed in §2.1.4 and §2.1.5: propagation across the network to the mempool, where any node can read it before confirmation; inclusion in a block, at a position chosen by the block producer according to their own criteria; and permanent, auditable recording in the network's history. Each stage leaks a different kind of information: in the mempool, who submitted, how much and when; in the block, the relative ordering among competing transactions; in the history, the possibility of reconstructing after the fact the entire sequence of bids of any auction ever held.

For a sealed-bid auction, this behaviour is the opposite of what the mechanism requires. A sealed-bid auction presupposes, by definition, that each participant decides their bid without knowing the bids of the others. When the execution infrastructure exposes the bids at the moment they are submitted, the attribute "sealed" ceases to have meaning: the participant who watches the mempool adjusts their strategy in real time, turning what should be an auction over private information into a sequential public negotiation.

The problem worsens when participants have unequal technical capabilities. An institutional investor assembling a large bid must price the asset based on their internal assessment of risk, liquidity and cost of capital. That assessment process is itself a proprietary asset, built over months or years of research. When the bid that reflects that assessment becomes public in the mempool, competitors with similar capital structures can infer, in fractions of a second, the submitter's internal pricing curve. The result tends to be a strong disincentive to institutional participation in public auctions. Platforms that depend on the participation of such players, especially those dealing with real-world assets, suffer the consequences in the form of lower liquidity and distorted market prices.

There is also a less obvious but equally relevant vector: retrospective forensic analysis. Even if an auction concludes without apparent incident, the permanent record of the bids exposes, forever, the pricing profile of each participant. In a competitive environment, that exposure becomes an input to every future auction, creating a cumulative effect in which each participation marginally reduces the informational advantage of recurring participants.

1.2.2 MEV and the economy of forced transparency

The observability of the mempool, combined with the control over transaction ordering held by whoever produces blocks, gave rise over the past decade to a parallel economy that extracts value precisely from privileged knowledge about pending transactions. This activity is generically called Maximal Extractable Value, or MEV.

Daian et al. (2020) introduced the term into academic debate through an empirical analysis of decentralised exchanges, demonstrating the systematic existence of bots specialised in exploiting the time window between the propagation and the confirmation of a transaction. Alipanahloo et al. (2024), in a more recent survey, organise the state of the art around the main forms of MEV and the mitigation strategies proposed by the community.

In the context of auctions on a public blockchain, three variants of MEV are especially worrying.

The first is frontrunning, a situation in which an observer, on detecting a pending bid in the mempool, submits their own transaction with a higher gas priority (the internal unit of Ethereum that measures the computational cost of a transaction and is converted into payment to the validator upon inclusion in a block). The bot thereby manages to be confirmed ahead of the original bid, altering the allocation or the closing price in its favour. In a Vickrey auction, frontrunning allows an observer to see the current highest bid and submit a slightly higher one, knowing they will pay only the second-highest price, that is, the original value they had copied.

The second is the sandwich attack, in which the bot inserts two transactions of its own, one immediately before and another immediately after the target transaction. The arrangement allows the bot to profit from the price movement caused by the user's transaction, and it is widely documented in automated market-making venues³. In auctions, the adapted form of the attack consists of inserting a fictitious bid to force the auction to a higher level and then a counter-bid that captures the spread (the difference between the buying and the selling price).

The third is reordering by validators. Unlike the two previous ones, it does not require prior observation: the block producer can simply choose the order of the transactions inside the block they assemble, favouring or harming specific bids according to their interest. The economy that emerges from that capability is studied under the name Proposer-Builder Separation, an architectural pattern that separates who proposes blocks from who actually assembles them, with the intent of limiting the reordering power concentrated in a single agent; the design admits variations that are partially successful as mitigations, but none eliminates the vector entirely.

The literature proposes stopgaps at the network and consensus level, such as private mempools, threshold encryption and deterministic ordering, discussed in §2.1.5; all exhibit the same pattern: they reduce the attack surface along one dimension and displace it to another, without eliminating the cause.

The practical consequence for auctions on a public blockchain is that any mechanism resting its security on keeping the bids in the mempool (even if only for a few seconds) operates on hostile ground. A fundamental solution requires that the bid never appear in plaintext during the entire life cycle of the transaction, from submission to confirmation, from submission to the auction's final decision.

1.2.3 Limits of the commit-reveal scheme

The classic answer of smart contract engineering to the problem of the exposed mempool is the commit-reveal scheme. Galal and Youssef (2018) describe this approach systematically in the specific context of verifiable sealed-bid auctions on Ethereum, and the pattern has since become the dominant stopgap in the ecosystem.

The idea is simple and attractive. In a first phase, called the commitment phase, the participant submits to the contract a cryptographic hash of their bid, along with a random nonce⁴. The hash does not reveal the value (thanks to the preimage properties of the cryptographic function used), but binds the participant to it irrevocably. In a second phase, called the reveal phase, and started only after the end of the commitment deadline, the participant reveals the original value and the nonce to the contract. The contract recomputes the hash and verifies that it matches the one committed. Inconsistent bids are rejected; consistent bids enter the final count.

The scheme has, however, four structural limitations.

The first is the user experience (UX) degraded by the double transaction. Each participant must send two transactions at distinct moments, with the risk of forgetting the second one, failing due to network congestion or simply not being available during the reveal window. Each transaction carries its own gas cost, doubling the nominal cost of participation. For the occasional participant, the friction is high; for the platform, the participation rate tends to be lower than in single-transaction mechanisms.

The second is non-reveal griefing (from grief, to sabotage; here, sabotage by means of non-revelation). Because the reveal happens in a time window after the commitment, a participant who already knows they have lost the auction (by observing the commitments of the others or simply by changing their mind) has an incentive not to reveal, leaving the result partially undetermined.

Usual mitigations involve a mandatory bond, exclusion by timeout (a deadline after which a participant who has not revealed is penalised or discarded) or automatic re-auctions, all of which add complexity to the contract and cost to the participant. Galal and Youssef (2018) discuss these mitigations in the verifiable case; in any event, none of them eliminates the vector without overlapping other costs.

The third is the final exposure of the losing bids. By construction, the commit-reveal scheme requires all bids to be revealed at the end so that the winner can be determined. The bids that did not win become public knowledge, exposing the pricing curve of each participant for all future auctions. The scheme preserves secrecy during the auction, but undoes it at the moment of finalisation. For recurring participants, the accumulated effect is that of a merely deferred transparency: secrecy is not guaranteed, only postponed until the close of each auction, so that each participant's pricing curve ends up exposed to competitors in the auctions that follow.

The fourth limitation is the natural incompatibility with Vickrey. In the Vickrey auction, it suffices to know which is the second-highest bid to compute the closing price. Under commit-reveal, however, at least the two highest values must be revealed (and, in practice, all of them, in order to know which are the two highest). Even if the scheme were adapted to reveal only the two highest, the runner-up, who lost the auction, would have their bid exposed, compromising secrecy precisely on the point that matters most for preserving that participant's future strategy. In other words, commit-reveal and Vickrey, although both address sealed-bid auctions, operate on incompatible privacy planes without some form of additional encryption over the values.

The combination of these four points indicates that commit-reveal is a partial solution: better than plaintext bids, but far from offering the secrecy required for on-chain Vickrey auctions to operate with the truthfulness property preserved and with losing bids effectively protected.

1.2.4 Real-World Assets as an application case

Real-World Assets, or RWA, designates the set of assets from the physical or traditional financial world represented as tokens on a blockchain. The category spans commercial receivables, fractions of real estate, royalties, debt securities, carbon credits, commodity-backed instruments and even works of art. The common thread among these assets is that their existence outside the blockchain must be represented, with some custody or legal-binding mechanism, in a form that is transferable and composable inside the blockchain.

This universe is distinct, in economic nature, from the universe of assets native to the crypto ecosystem. Native assets (cryptocurrencies, protocol tokens, speculative NFTs⁵) are, for the most part, backed only by expectations and protocol rules. Real-world assets, by contrast, have value independent of the blockchain and operate under traditional financial logic: cash flows, maturities, interest rates, collateral. That difference changes the profile of the participants. Whereas auctions of native tokens attract mostly individual participants with high risk appetite, RWA auctions attract institutional investors, that is, professional fund managers, bank proprietary trading desks (areas in which the bank invests its own capital), family offices⁶ and pension funds, all subject to strict risk mandates and to strong competitive secrecy pressures.

Several platforms operate actively in this space. Ondo Finance (2026) distributes tokens backed by US Treasury securities. Centrifuge (2026) intermediates commercial receivable tokens. Maple Finance (2026) manages private credit pools backed by institutional loans. Each of these platforms, at some point in its flow, must allocate new tokens to investors, and the way that allocation is carried out defines the fairness of the initial price and the satisfaction of the participants. Some of these allocations occur by auction; others, at a fixed price with a priority list; still others, through hybrid mechanisms. In all of them, secrecy of the investor's intent is a desired property, even if rarely preserved in practice.

An illustrative case of the relevance of the intersection between FHE and RWA is the Zaiffer Protocol (ZAIFFER, 2026), a joint venture⁷ between Zama and PyratzLabs announced in 2026. The initiative is concrete evidence that applying homomorphic encryption to RWA flows is not speculative: there is production engineering effort invested in enabling exactly the kind of mechanism this work investigates.

RWA combines four factors that make the conflict between blockchain transparency and participant secrecy sharper than in other auction applications: high concentration of institutional capital, high competitive sensitivity, high cost of leaked information and concrete market demand. That is why this domain is used as the application example throughout the work.

1.2.5 Synthesis: the opportunity of FHE

The previous points converge on a simple observation. Auctions on a public blockchain need, simultaneously, two properties that the native infrastructure does not offer: that the bids remain secret throughout the entire execution cycle, and that only what is strictly necessary for the mechanism to work be revealed at the end. The existing schemes offer one of those properties, but not both. Plaintext bids offer neither. The commit-reveal scheme offers secrecy during the auction, but requires the complete revelation of all bids at the end. Private mempools protect the individual transaction, but do not eliminate post-confirmation observability. Threshold encryption at the consensus level is not yet in production and depends on honesty assumptions.

Fully Homomorphic Encryption operates differently. Instead of temporarily hiding the bid, it allows the bid to remain encrypted end to end, and the computation of the winner and the closing price to happen directly over the encrypted data. When the result is finally decrypted, only what is strictly necessary (in Vickrey's case, the second-highest price and the identity of the winner) is exposed. The losing bids never appear in plaintext, at any moment, anywhere.

That property, the permanent secrecy of the losing bids, is what motivates the remainder of this work. The following sections formalise the research problem (§1.3), the hypothesis under investigation (§1.4) and the specific objectives (§1.5) that give shape to the investigation.

1.3 Research problem

Two complementary questions guide this work. The first, primary and constructive in nature, is the following:

Is it possible to run a Vickrey auction on a public blockchain without leaking any bid beyond the closing price, preserving the truthfulness property?

Answering it requires demonstrating that an implementation exists capable of satisfying the privacy and incentive guarantees simultaneously, executable on a real public blockchain, and formally characterising what the mechanism reveals under an explicit adversary model, including the residual uncertainty about the unrevealed bids. The second question, secondary and evaluative in nature, follows from the first:

At what operational cost, in gas and in latency, is such an execution viable?

Answering it requires measuring, in a reproducible way, the cost of the implementation, so that the reader understands what is paid for adopting the proposed approach.

1.4 Hypothesis

The hypothesis investigated by this work is the following:

H: it is possible to implement a Vickrey auction on a public blockchain using Fully Homomorphic Encryption through the Fhenix CoFHE platform in such a way as to preserve simultaneously (a) the permanent secrecy of all individual bids, with the exception of the controlled revelation of the second-highest price at the end of the process; (b) the truthfulness property intrinsic to the Vickrey mechanism; and (c) practical viability in a public testnet environment (a test network that replicates the operation of the main network, with no real financial value) at the scale of small to medium institutional auctions (up to around ten participants), under measurable and documented gas and latency costs.

The validation of this hypothesis is carried out through the implementation of a Solidity contract on Fhenix CoFHE, accompanied by a web interface and deployment on a public testnet, described in Chapter 4 and evaluated in Chapter 5.

1.5 Objectives

The objectives are presented at two levels: the General Objective (§1.5.1) states the central deliverable of the work, and the Specific Objectives (§1.5.2) break it down into verifiable results.

1.5.1 General Objective

To investigate the technical and empirical viability of running confidential Vickrey auctions on a public blockchain through the complete implementation of the mechanism on Fhenix CoFHE, characterising its computational cost (gas, latency, calldata size), its information-leakage profile under an explicit adversary model and its practical viability on a public testnet.

1.5.2 Specific Objectives

Achieving the general objective requires the fulfilment of six specific objectives, each addressed in one or more chapters of the work.

1. To characterise the information-leakage problem in native public-blockchain auctions, as well as the limits of the existing approaches to mitigating it (the commit-reveal scheme, private mempools, threshold encryption proposals at the consensus level). This objective is addressed in §1.2 and in Chapters 3 and 4.

2. To implement a Solidity contract for a private Vickrey auction on Fhenix CoFHE (ConfidentialVickreyAuction.sol), solving the exclusion problem and the deterministic handling of ties over the primitives of Fhenix's FHE.sol. This objective is addressed in Chapter 4.

3. To build a web interface with encryption performed in the user's own browser via WebAssembly⁸ through the @cofhe/sdk package, enabling an interactive demonstration of the auction among real users on a public testnet. This objective is addressed in Chapter 4.

4. To carry out a functional end-to-end deployment on a public testnet with Fhenix CoFHE active (Arbitrum Sepolia or an equivalent network) and to validate the correctness of the mechanism by running a real auction among multiple participants, integrating the contract, Fhenix's Threshold Services Network (a network of nodes that jointly holds, through cryptographic sharding, the decryption key, and requires the cooperation of a minimum quorum among them to reveal any encrypted value) and the graphical interface developed. This objective is addressed in Chapters 4 and 5.

5. To evaluate the implementation empirically along two complementary axes: (a) computational cost, measuring gas (per operation and in total), latency per phase, user-perceived latency and calldata size (the portion of a transaction that carries the arguments of the function call, charged in gas according to its volume) in populations of 3, 5 and 10 participants, with at least five repetitions per configuration; and (b) information leakage under an explicit adversary model, with a qualitative analysis (capability table) and a quantitative one (residual uncertainty about the losing bids). This objective is addressed in Chapters 4 and 5.

6. To discuss the trade-offs, limitations and threats to validity of the work, as well as to point out directions for future extension, in particular the controlled empirical comparison with commit-reveal and plaintext baselines, the generalisation to multi-unit auctions (in which several units of the same asset are offered and allocated simultaneously) and the application of the architectural pattern to other auction mechanisms (Dutch, English, double auction). This objective is addressed in Chapters 5 and 6.

Achieving these six objectives is what makes it possible to answer the research questions formulated in §1.3 and to test the hypothesis formulated in §1.4.

1.6 Scope

This work concentrates on:

• A single-unit Vickrey auction, that is, a single item offered and a single winner per auction instance.
• A single Solidity contract on Fhenix CoFHE, with no comparative implementations.
• Empirical characterisation of the implementation (gas per operation and per complete auction, latency per phase, calldata size) in populations of 3, 5 and 10 participants, with at least five repetitions per configuration.
• A functional end-to-end demonstration on a public testnet, with a real auction run among multiple participants.
• A web interface performing client-side encryption via @cofhe/sdk and exposing the complete auction flow (submission of encrypted bids, closing, client-orchestrated revelation of the result).
• A formal analysis of information leakage under an explicit adversary model, with a quantitative component of residual uncertainty about the losing bids.
• The use of the Real-World Assets domain solely as an illustrative narrative that motivates and contextualises the mechanism; the RWA tokens used in the demonstration are simulated, with no integration with real assets.

Explicitly out of scope:

• Comparative implementations in commit-reveal or in plaintext, and the corresponding comparative benchmark. These schemes are discussed qualitatively in Chapters 3 and 4, without being implemented or measured empirically in this work.
• A multi-unit version of the auction, that is, multiple items offered simultaneously. The extension is mentioned in Chapter 6 as future work.
• A practical comparison with systems based on Zero-Knowledge Proofs (ZKPs). Such systems are cited in related work (Chapter 3) as an architectural reference point, but are neither implemented nor evaluated empirically.
• Discussion of regulatory, legal or normative aspects, of compliance, of mandatory customer identification (Know Your Customer, KYC) or of Anti-Money Laundering (AML), which fall outside the technical framing of the work.
• Advanced gas optimisations beyond the standard of the Fhenix CoFHE platform. Any improvements arising during implementation are welcome, but do not constitute a central objective.
• Extensive statistical analysis of the empirical measurements. The figure of five repetitions per configuration is a limitation accepted in view of the gas cost on a public testnet; mean and standard deviation are reported as indicators, not as a formal statistical test.

1.7 Contributions

This work offers the following contributions:

1. A Vickrey implementation on Fhenix CoFHE: a Solidity contract (ConfidentialVickreyAuction.sol) running a private Vickrey auction on Fhenix CoFHE, with the exclusion problem and the deterministic handling of ties solved over the primitives of Fhenix's FHE.sol. It constitutes, as far as could be verified in the literature consulted, the first documented academic implementation of a private Vickrey auction on Fhenix CoFHE, complementing the official proof-of-concept (PoC) maintained by Fhenix, a demonstrative implementation of viability with no claim to production use, which covers only the first-price case (FHENIX, 2026c).

2. An empirical characterisation of cost: reproducible measurement of gas per operation and per complete auction, latency per phase and calldata size of the Fhenix implementation in synthetic populations of 3, 5 and 10 participants, with at least five repetitions per configuration. The results are presented with mean and standard deviation.

3. A structured analysis of information leakage: an explicit adversary model, a table of capabilities observable in the Fhenix implementation and a quantitative measure based on residual uncertainty about the losing bids. The analysis makes it possible to state formally what the adversary learns at the end of the auction and what remains protected.

4. A functional end-to-end demonstration on a public testnet, accompanied by a usable graphical interface: deployment of the contract on a public testnet, with a real auction run among multiple participants through a web interface that encrypts the bid in the browser via @cofhe/sdk and exposes the complete flow of submission, closing and client-orchestrated revelation of the result. The demonstration proves the viability of the approach outside a simulated environment and offers a reproducible artefact for third-party validation.

The set of contributions above constitutes the original axis of this work. The homomorphic masking technique for computing the second-highest value over encrypted bids, central to the implementation, is discussed in various sources across the on-chain FHE ecosystem, including grey literature (Faruukku, 2026); Chapter 4 details the formalisation adopted here and its port to Fhenix CoFHE. The originality of this investigation lies in delivering, as far as could be verified in the literature consulted, the first documented academic implementation of a private Vickrey auction on Fhenix CoFHE, accompanied by a formal leakage analysis under an explicit adversary model and by end-to-end validation on a public testnet with a reproducible graphical interface.

1.8 Structure of the work

The following chapters present, in this order, the elements required for the proposed investigation.

• Chapter 2 presents the theoretical background required to understand the remainder of the text, including concepts of blockchain, cryptography, Fully Homomorphic Encryption, its TFHE variant, the Fhenix CoFHE platform adopted, sealed-bid auction theory, the truthfulness property, and a discussion of resistance to quantum attacks.

• Chapter 3 reviews related work, organised into seven thematic groups: foundations of FHE and post-quantum cryptography, confidential contracts over FHE, auction theory, pre-blockchain private auctions, on-chain auctions and privacy, MEV and mitigations, and technical engineering literature.

• Chapter 4 presents the development of the work in four integrated blocks. §4.1 formalises the problem and the threat model, describing the adversary considered and the privacy objectives required. §4.2 presents the proposed solution, with emphasis on the FHE architecture, on the so-called exclusion problem (computing the second-highest value without decrypting the winner), on the handling of ties and on the high-level execution flow. §4.3 specifies and models the system, covering requirements, Actors and Use Cases, the data model, the contract interface, the FHE operations, Sequence Diagrams and the state machine. §4.4 describes the concrete implementation: the Solidity contract, the web interface, the deployment on a public testnet and the structure of the test suite (in a Hardhat environment with a CoFHE mock, a local simulation of the coprocessor that dispenses with network and gas cost). §4.5 closes the chapter by consolidating, in a table, the guarantees obtained by the architecture and the mechanisms that sustain them.

• Chapter 5 presents the evaluation methodology and the results collected, including gas and latency measurements of the Fhenix implementation and a quantitative analysis of information leakage, followed by a discussion of trade-offs, limitations observed and threats to the validity of the work.

• Chapter 6 concludes the text and points out directions for future work, including the extension to multi-unit auctions, scalability and the application of the principles presented to other auction mechanisms.