Themis Consensus Extension v1: MEV Mitigation by Randomized Delayed Execution and Intent-Hiding Transactions in Application-Specific Blockchains

Gleb Urvanov; Mateusz Nowakowski; Peter Kris; Shoeb Siddiqui; Stanislav Vozarik

Themis Consensus Extension v1: MEV Mitigation by Randomized Delayed Execution and Intent-Hiding Transactions in Application-Specific Blockchains

T0 review · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper specifies and analyzes a consensus extension that splits block content and execution order across two consecutive producers, showing that under non-collusion it limits unilateral MEV reordering and hides transaction intent.

desk verdict A careful, honest formalization of the 2021 Themis/Mangata MEV design; the central guarantee is explicitly conditional, but the formal proposition silently assumes distinct adjacent roles while the spec permits a single validator to hold both. read the letter →

arxiv 2607.21406 v1 pith:NMV7CFAY submitted 2026-07-23 cs.CR

Shoeb Siddiqui , Mateusz Nowakowski , Stanislav Vozarik , Gleb Urvanov , Peter Kris This is my paper · ORCID

classification cs.CR

keywords MEVtransactionorderingrandomizeddelayedexecutionintenthidingencryptedmempoolverifiablerandomfunctiondecentralizedexchangeconsensusextension

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper rigorously restates and analyzes a previously informal consensus extension for application-specific blockchains, targeting two forms of MEV: value extraction by reordering (VER) and by denial (VED). It claims that if transaction-set commitment and execution-order derivation are split across two consecutive block producers, and the order is determined by a verifiable, unpredictable seed from the next producer, then neither the builder nor the executor can unilaterally choose an arbitrary execution permutation. It further claims that an optional two-layer encryption scheme hides transaction intent from relays and the builder until commitment, reducing selective censorship. The paper explicitly limits these guarantees to a threat model of selfish but non-colluding validators, an adversary below the consensus fault threshold, and accountable role performance, and it documents residual attacks including total denial, probabilistic extraction, and builder-executor collusion.

What carries the argument

The two-stage pipeline: block n's producer commits transaction set T_n; block n+1's producer evaluates a unique-output primitive (a verifiable random function or deterministic signature) over consensus-fixed inputs to derive seed s_n, computes a dependency-preserving shuffle σ_n = Shuffle(T_n, s_n) that preserves each sender's nonce order, and executes the shuffled set. For denial mitigation, the protocol uses two-layer authenticated hybrid encryption: the user encrypts the transaction for the executor, then wraps that ciphertext for the builder; the builder removes its layer and commits the opaque inner ciphertext, and the executor opens it only after commitment.

What would settle it

Find two distinct valid encodings of the same committed transaction set that lead to different VRF seeds; this would let a builder grind toward a favorable permutation and falsify the claim that the set is binding before the seed is known. Alternatively, observe a deployment where one operator holds the private keys for two consecutive producer slots and uses that control to place its own transactions favorably, which would falsify the practical guarantee.

Watch

Extended reading notes

Core claim

The central claim is Proposition 1: assuming the transaction set is binding before the seed is known, the unique-output primitive (e.g., a VRF) does not allow output grinding, builder and executor do not collude, and the shuffle is deterministic and correctly validated, then neither role can unilaterally choose an arbitrary execution permutation of the committed set. The paper also specifies a two-layer encrypted transaction path that lets a user target a specific builder-executor pair; the builder removes an outer layer and commits an opaque inner ciphertext, and the executor reveals the plaintext only after commitment. The result narrows the original proposal's sweeping promises to an expl

Load-bearing premise

The entire ordering and intent-hiding guarantee rests on the assumption that the validator who builds a block and the validator who executes it in the next slot do not cooperate; if one operator controls both adjacent roles, the separation of powers disappears and the protocol's protections collapse.

Editorial extensions

If this is right

Under the stated assumptions, a builder can no longer time its own transactions relative to a user's to get a guaranteed favorable position; it can only pick a set whose expected payoff over all possible orders is favorable.
An executor cannot insert transactions into an already committed set; it can only abort or withhold, which becomes an objectively detectable liveness failure subject to slashing.
The protocol converts direct ordering control into a constrained availability/inclusion decision, shifting MEV mitigation from cryptography alone to a combination of randomness, role separation, and accountability.
Intent-hiding encryption can reduce selective censorship based on transaction purpose, but metadata and total denial remain, so deployment requires fixed fees, expiry rules, and penalties calibrated to opportunity size.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The VER/VED decomposition suggests a general audit heuristic: for any MEV opportunity, ask which actor learns intent, which controls membership, and which controls relative order; this could be applied to other consensus designs beyond the one specified.
The one-block delay implies that security scales with the unpredictability of the next producer's VRF output; if a producer can grind over alternative valid encodings of the committed transaction set, the binding guarantee fails, motivating a requirement for canonical serialization rather than mere hashing.
The explicit non-collusion assumption between adjacent roles is stronger than the consensus fault threshold, so the protocol's security can break even while consensus remains honest; a natural testable extension would randomize role assignment to make adjacent-slot control by one operator exponentially unlikely.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper is a formal restatement of the 2021 Mangata Themis proposal, not a new mechanism. What is new: a precise protocol specification, an explicit threat model, and a security analysis that honestly narrows the original claims. Proposition 1 is elementary but valid, and the paper is unusually candid about residual attacks, listing probabilistic extraction, total denial, and collusion as out of scope. It also documents the Aura-to-BABE implementation evolution without overclaiming reproducibility. Credit where due: this is a disciplined write-up of someone else's design, and it says so clearly.

The soft spot is real and load-bearing. The central guarantee—unilateral-order resistance—requires that builder and executor not collude. But the spec explicitly allows a single validator to occupy adjacent slots (Section 2.2). In that case, the validator controls both the block-n builder key and the block-n+1 executor key, so it can compute the seed before committing T_n and choose a transaction set with a known favorable ordering. That is not collusion between parties; it is one party holding both roles, and it breaks Proposition 1's assumption (iii). The paper does flag this in Section 7.4 as a 'concern' about repeated producers and operator-level key ownership, but it does not carry that concern into the formal model or the abstract. Either the VER pipeline needs a role-diversity rule (as VED has in Section 6.6) or the guarantee should be stated as conditional on distinct operators, not merely non-collusion.

Two smaller soft spots: the nonce-constrained shuffle distribution is left unspecified, which the paper admits is security-critical, and decryption liveness and session-boundary rules remain open questions. Neither is fatal; the paper is explicit that these are v1 limitations.

Overall, the paper is a useful reference specification for application-specific DEX chains, not a breakthrough. It deserves a serious referee if the field wants a precise, honest account of the Themis design—but the authors should fix the role-distinctness assumption and pin down the shuffle sampler before publication. I'd send it to peer review with that expectation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central security claim is an explicitly conditional proof, and the self-authored citations are historical implementation reports rather than load-bearing evidence.

full rationale

The main security result, Proposition 1 (§5.3), is stated as a conditional implication from explicit assumptions (i)–(iv): binding commitment before seed knowledge, a non-grindable unique-output primitive, non-collusion between builder and next producer, and a deterministic validated shuffle. Its proof unpacks those assumptions, which is a standard conditional security argument rather than a derivation that assumes its own conclusion or fits a parameter to make a result appear. The protocol equations (§5.2, Eqs. 1–5) define the delayed-execution mechanism; they are not retrofitted to match an observed output. No empirical prediction is made, and no fitted parameter is renamed as a forecast. The paper explicitly narrows its guarantees and lists residual risks (§7, Table 1), including builder-executor collusion (§7.6), threshold coalitions (§7.7), role repetition (§7.4), grinding (§7.4), total denial (§7.5), and metadata leakage (§7.8). The references to prior Mangata work ([9], [10], [11], [12]) support the historical and implementation-report portions, and the paper itself cautions that reproducibility requires immutable commits (§9.4) and that some statements are historical reports from the original team. These self-citations are not load-bearing for the security derivation. The concern that a single validator occupying adjacent slots can defeat the role split is acknowledged in §2.2 and §7.4 and is a scope/assumption limitation, not a circular step: the proposition's conclusion holds only when its stated non-collusion premise holds, and the paper does not claim otherwise. The VER/VED decomposition is explicitly called a design lens rather than a proof or discovery (§4, §8.5), so it is not a renamed empirical result. Overall, the derivation chain is self-contained under its stated assumptions and exhibits no circularity requiring a score above zero.

Assumptions & free parameters 0 free parameters · 8 assumptions · 0 invented entities

The central claim rests on eight domain assumptions rather than on fitted parameters. The most critical are adjacent-role non-collusion and the unspecified unbiased shuffle. The paper is transparent about these, but they remain assumptions to be validated in deployment, not results proven in the paper.

assumptions (8)

domain assumption Adjacent-role non-collusion: the producer that commits T_n (builder) and the producer that computes the execution seed (executor P_{n+1}) do not cooperate; a single operator does not control both roles in a slot pair.
Essentially all VER/VED protections collapse if builder and executor collude; stated in §3.3 and §7.6 as an explicit exclusion, and identified as the structurally weakest assumption.
domain assumption Underlying consensus is secure below threshold: adversarial coalition stays below the Byzantine/economic fault threshold and cannot rewrite commitments or suppress evidence.
§3.2 lists this as assumption 1; the paper notes coalitions at or above threshold invalidate all guarantees.
domain assumption Unique-output primitive (VRF or deterministic unique signature) with public verifiability and output unpredictability before commitment; no output or input grinding.
§3.4, §5.4, and §7.4 require uniqueness and canonical inputs; if the seed can be ground or predicted, the order can be controlled.
domain assumption Authenticated hybrid encryption with confidentiality/integrity, domain-binding metadata, key publication, and expiry, used for the two-layer VED path.
§3.4 and §6.1 state encryption must be authenticated and bound to chain/session/roles; otherwise intent can leak or ciphertexts become undecryptable.
domain assumption The dependency-preserving shuffle sampler is unbiased for its stated fairness objective over admissible permutations.
§5.5 explicitly says the distribution over Adm(T_n) is implementation-dependent and security-critical but not specified; the conditional symmetry claim in §5.6 depends on it.
domain assumption Future producer roles and public keys are known/discoverable, so wallets can target the right builder/executor pair.
§6.2 says target-role discovery is required; unpredictable proposer (PoW) adaptation remains a design hypothesis, not a complete protocol.
domain assumption Economic parameters (fixed fees, commissions, failed-transaction charges) and penalties are large enough to cap spam and punish withholding.
§8.1 and §7.3 rely on fee levels and penalties, which the paper says are parameter-dependent and unmeasured.
domain assumption Metadata (sender, timing, size, network path, choice to use the protected path) does not reveal transaction intent.
§6.3 says metadata can reveal intent and padding/batching may be needed; the selective-VED claim is conditional on this.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Themis Consensus Extension v1: MEV Mitigation by Randomized Delayed Execution and Intent-Hiding Transactions in Application-Specific Blockchains." pith.science (2026). https://pith.science/paper/NMV7CFAY

@misc{pith2026260721406,
  author       = {Pith},
  title        = {Pith review of: Themis Consensus Extension v1: MEV Mitigation by Randomized Delayed Execution and Intent-Hiding Transactions in Application-Specific Blockchains},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NMV7CFAY}},
  note         = {Machine review of arXiv:2607.21406}
}

read the original abstract

Maximal extractable value (MEV) arises when privileged participants select, exclude, insert, or reorder pending transactions for private gain. We specify and analyze the Themis Consensus Extension v1, first published by Mangata in 2021. The design separates value extraction by reordering (VER) from value extraction by denial (VED). For VER, block construction and execution occur across consecutive producers: one producer commits a transaction set, and the next derives a publicly verifiable, deterministic, previously un- predictable seed and executes a seed-determined, dependency-preserving permutation. For selective VED, a user may encrypt a transaction for a designated builder and executor. The builder removes an outer layer and commits the opaque inner ciphertext; the executor reveals and executes the plaintext only after commitment. Under selfish but non-colluding validators, an adversary below the underlying consensus fault threshold, secure cryptography, and accountable role performance, the construction limits unilateral post-commit ordering control and hides transaction intent from relays and the builder. It does not provide send-order or receive-order fairness, complete censorship resistance, resistance to builder-executor collusion, or per-transaction price guarantees. We analyze probabilistic extraction, spam, dependent transactions, decryption liveness, session boundaries, total denial, and threshold coalitions. We also document the initial Aura-based Substrate implementation and its subsequent transition to a BABE-based sr25519/VRF seed path, together with delayed execution, Fisher-Yates shuffling, and Xoshiro256++. The result preserves the original proposal while narrowing its claims to explicit assumptions.

Figures

Figures reproduced from arXiv: 2607.21406 by the authors.

**Figure 2.** Two-layer intent-hiding path for selective VED mitigation. Encryption reduces the [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 1 canonical work pages

[1]

M. I. Alnajjar, M. S. Kiraz, A. Al-Bayatti, and S. Kardas. Mitigating MEV attacks with a two-tiered architecture utilizing verifiable decryption.EURASIP Journal on Wireless Communications and Networking, 2024:62, 2024.https://doi.org/10.1186/ s13638-024-02390-4

2024
[2]

Blackman and S

D. Blackman and S. Vigna. Scrambled linear pseudorandom number generators.ACM Transactions on Mathematical Software, 47(4):36:1–36:32, 2021.https://doi.org/10. 1145/3460772. 18 Original question Answer in this specification Is the protocol receive-order or send- order fair? No. It uses post-commit randomized ordering; see Sections 2.3 and 5. How is probab...

2021
[3]

Daian, S

P. Daian, S. Goldfeder, T. Kell, Y. Li, X. Zhao, I. Bentov, L. Breidenbach, and A. Juels. Flash Boys 2.0: Frontrunning, transaction reordering, and consensus instability in decen- tralized exchanges. In2020 IEEE Symposium on Security and Privacy (SP), pages 910–927. IEEE, 2020.https://doi.org/10.1109/SP40000.2020.00040

arXiv 2020
[4]

Durstenfeld

R. Durstenfeld. Algorithm 235: Random permutation.Communications of the ACM, 7(7):420, 1964.https://doi.org/10.1145/364520.364540

arXiv 1964
[5]

Develop an MEV taxonomy.GitHub issue 24, flashbots/mev-research, 2020

Flashbots MEV Research Contributors. Develop an MEV taxonomy.GitHub issue 24, flashbots/mev-research, 2020. Accessed July 2026

2020
[6]

Kelkar, F

M. Kelkar, F. Zhang, S. Goldfeder, and A. Juels. Order-fairness for Byzantine consensus. InAdvances in Cryptology – CRYPTO 2020, LNCS 12172, pages 451–480. Springer, 2020. https://doi.org/10.1007/978-3-030-56877-1_16

doi:10.1007/978-3-030-56877-1_16 2020
[7]

Kelkar, S

M. Kelkar, S. Deb, S. Long, A. Juels, and S. Kannan. Themis: Fast, strong order-fairness in Byzantine consensus. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 475–489. ACM, 2023.https://doi.org/10. 1145/3576915.3616658

arXiv 2023
[8]

K. Kursawe. Wendy, the good little fairness widget: Achieving order fairness for blockchains. InProceedings of the 2nd ACM Conference on Advances in Financial Tech- nologies (AFT), pages 25–36. ACM, 2020.https://doi.org/10.1145/3419614.3423263

arXiv 2020

Show all 15 references

[9]

Mangata Engineering Team. Mangata: Delayed transaction execution and randomized ordering engineering note.Source repository design note, 2021.https://github.com/ gasp-xyz/mangata-node/blob/develop/Mangata.md. Accessed July 2026

2021
[10]

Mangata node source repository.GitHub repository, 2021

Mangata Engineering Team. Mangata node source repository.GitHub repository, 2021. https://github.com/gasp-xyz/mangata-node. Accessed July 2026

2021
[11]

Tech talk: Modifying the block execution in Substrate.Mangata technical blog, Nov

Mangata Team. Tech talk: Modifying the block execution in Substrate.Mangata technical blog, Nov. 20, 2021. Talk presented by Mateusz Nowakowski at Sub0. Accessed July 2026

2021
[12]

Introducing Themis Consensus Extension v1: A solution to MEV for application-specific blockchains.Mangata blog, Oct

Mangata Team. Introducing Themis Consensus Extension v1: A solution to MEV for application-specific blockchains.Mangata blog, Oct. 10, 2021. Accessed July 2026

2021
[13]

Micali, M

S. Micali, M. Rabin, and S. Vadhan. Verifiable random functions. In40th Annual Symposium on Foundations of Computer Science (FOCS), pages 120–130. IEEE, 1999. https://doi.org/10.1109/SFFCS.1999.814584

1999
[14]

A. Obadia. Frontrunning the MEV crisis.Flashbots publication, Nov. 23, 2020. Accessed July 2026

2020
[15]

Rondelet and Q

A. Rondelet and Q. Kilbourn. On the economic implications of private mempools.arXiv preprint arXiv:2307.10878, 2023.https://doi.org/10.48550/arXiv.2307.10878. 20

2023 doi arXiv

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.

[1] [1]

M. I. Alnajjar, M. S. Kiraz, A. Al-Bayatti, and S. Kardas. Mitigating MEV attacks with a two-tiered architecture utilizing verifiable decryption.EURASIP Journal on Wireless Communications and Networking, 2024:62, 2024.https://doi.org/10.1186/ s13638-024-02390-4

2024

[2] [2]

Blackman and S

D. Blackman and S. Vigna. Scrambled linear pseudorandom number generators.ACM Transactions on Mathematical Software, 47(4):36:1–36:32, 2021.https://doi.org/10. 1145/3460772. 18 Original question Answer in this specification Is the protocol receive-order or send- order fair? No. It uses post-commit randomized ordering; see Sections 2.3 and 5. How is probab...

2021

[3] [3]

Daian, S

P. Daian, S. Goldfeder, T. Kell, Y. Li, X. Zhao, I. Bentov, L. Breidenbach, and A. Juels. Flash Boys 2.0: Frontrunning, transaction reordering, and consensus instability in decen- tralized exchanges. In2020 IEEE Symposium on Security and Privacy (SP), pages 910–927. IEEE, 2020.https://doi.org/10.1109/SP40000.2020.00040

arXiv 2020

[4] [4]

Durstenfeld

R. Durstenfeld. Algorithm 235: Random permutation.Communications of the ACM, 7(7):420, 1964.https://doi.org/10.1145/364520.364540

arXiv 1964

[5] [5]

Develop an MEV taxonomy.GitHub issue 24, flashbots/mev-research, 2020

Flashbots MEV Research Contributors. Develop an MEV taxonomy.GitHub issue 24, flashbots/mev-research, 2020. Accessed July 2026

2020

[6] [6]

Kelkar, F

M. Kelkar, F. Zhang, S. Goldfeder, and A. Juels. Order-fairness for Byzantine consensus. InAdvances in Cryptology – CRYPTO 2020, LNCS 12172, pages 451–480. Springer, 2020. https://doi.org/10.1007/978-3-030-56877-1_16

doi:10.1007/978-3-030-56877-1_16 2020

[7] [7]

Kelkar, S

M. Kelkar, S. Deb, S. Long, A. Juels, and S. Kannan. Themis: Fast, strong order-fairness in Byzantine consensus. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 475–489. ACM, 2023.https://doi.org/10. 1145/3576915.3616658

arXiv 2023

[8] [8]

K. Kursawe. Wendy, the good little fairness widget: Achieving order fairness for blockchains. InProceedings of the 2nd ACM Conference on Advances in Financial Tech- nologies (AFT), pages 25–36. ACM, 2020.https://doi.org/10.1145/3419614.3423263

arXiv 2020