MEV in multiple concurrent proposer blockchains

1 Introduction

In this work, we formalize several new maximal extractable value (MEV) and collusion games introduced by multiple concurrent proposer (MCP) blockchains that are absent from sequential chains. We actively avoid discussing related problems such as transaction fee mechanisms (TFMs) and pricing in this work, and where auctions are discussed, a generic EIP-1559-style mechanism with an inclusion price and an optional priority fee is assumed. As blockchains strive to scale, three clear paths have appeared in industry: zero-knowledge (ZK) approaches, which today generally rely on a single sequencer, sharded approaches such as NEAR (Skidanov and Polosukhin, 2019), and, more recently, MCP approaches (Garimidi et al., 2025; Marsh et al., 2025; Neuder and Resnick, 2024; Fox and Resnick, 2023; Li et al., 2020). In an MCP model, each proposer in the network can propose one or more blocks in each tick of the system, as opposed to the single proposer in a traditional sequential model. This model allows for a higher block production rate and a limited impact of an offline producer in any given tick of the system.

We now describe, loosely, a simplified version of Sei Giga (Marsh et al., 2025), which will be used as an example of an MCP blockchain in this work. We assume an Autobahn (Giridharan et al., 2024)-style Byzantine fault tolerance (BFT) consensus protocol with a separate data dissemination (DD) and consensus layer; see also Spiegelman et al. (2022) and Babel et al. (2024). In such a protocol, transactions are sent to remote procedure call (RPC) nodes where they are randomly allocated, uniformly, to any staked proposer in the network. There is no global mempool, although any proposer could run a local mempool. The proposer is then able to publish blocks as and when they desire to the DD layer. Once a block is on the DD layer, it is gossiped to at least f + 1 proposers to generate a proof of availability (Cohen et al., 2023) certificate. Each tick of the system, which happens every circa 300 ms, a consensus proposal is made over the blocks with valid proofs of availability (PoAs), without the blocks being gossiped to all voters. The blocks are executed after consensus, with all blocks in the tick being executed as a single large block, to allow for dependencies between transactions sent to different proposers to be handled. Any invalid transactions or duplicate transactions are not executed and can be pruned by anyone but an archive node.

In this work, we assume an EIP-1559-style TFM with a posted price inclusion fee for execution, which is burned, and a tip that is given to the proposer. Because most decentralized finance (DeFi) flows involve tightly coupled multi-hop transactions, MCP concurrency introduces reaction surfaces that simply do not exist in single builder mempools. We establish a hazard-normalized delay model for the MCP MEV, deriving a closed-form delay envelope M ( τ ) and an immediate-inclusion threshold τ †, extending sequential chain delay models to the concurrent setting. We then formalize MCP-specific MEV channels, such as same-tick duplicate steals, proposer-to-proposer auctions, PoA-latency timing races, and multi-submission externalities, and give explicit cutoff conditions for censorship, stealing, auctions, timing, and spam. Finally, we propose two protocol mechanisms that neutralize same-tick extraction, duplicate-aware tip splitting, which collapses the duplication prize, and a deterministic priority-directed acyclic graph (DAG) merge scheduler that preserves dependencies while enforcing tip priority. These mechanisms compress timing races and identify PoA rate as the core determinant of stealability, isolating which MEV channels are intrinsic to the MCP and which can be pushed to ε through straightforward protocol choices. Same-tick ordering affects not only classic automated market maker (AMM) arbitrage but also cascading DeFi events such as oracle writes, funding rate adjustments, and multi-venue liquidation waterfalls.

Definition 1 (MCP tick execution window): An MCP blockchain proceeds in discrete ticks. During tick t, multiple proposers may publish blocks to a DD layer. A block becomes eligible in tick t upon obtaining a PoA certificate before the tick boundary. Consensus selects a bounded set of eligible blocks, which are then merged by a deterministic rule into a single per-tick execution order.

1.1 A typical MCP pipeline

To make the MCP setting concrete, we summarize a simplified Sei Giga-style pipeline and explicitly mark the information sets that enable MCP-specific MEV channels. Time is divided into ticks. During each tick t, the process begins privately with transaction ingress. Users submit signed transactions to RPC nodes, which then assign each transaction to a single proposer based on a stake-weighted distribution, notably avoiding a global mempool. Following this, each proposer begins local block construction, collecting received transactions into a candidate block B i t. At this stage, the proposer holds private knowledge of the block’s contents and retains the power to delay, drop, or auction access to it. The process then transitions to a public phase during the DD publish step. The proposer publishes its block data to the data dissemination (DD) layer, making the block contents publicly observable before the final execution order is fixed. Immediately after publishing, the proposer engages in PoA collection, racing to secure ℓ = f + 1 availability co-signatures to obtain a proof of availability (PoA). This certification is mandatory, as only PoA-certified blocks are eligible for inclusion in the current tick. As the tick concludes, the system reaches the tick boundary and consensus set selection. Consensus mechanisms select a bounded set of PoA-certified blocks without requiring all blocks to be fully gossiped to all voters. Once selected, the protocol applies deterministic merge ordering to combine transactions from these blocks into a single per-tick execution sequence, typically utilizing a priority order subject to dependencies. Finally, the pipeline concludes with execution and payouts. All selected blocks are executed together as a single “mega block,” where invalid transactions and duplicates are skipped and pruned based on deterministic rules. Base fees are then burned, and tips are distributed to the proposers according to the protocol’s duplicate-aware payout rules. Ultimately, the defining characteristic of this MCP model, compared to traditional sequential chains, is the public reveal of block data before final ordering. This specific window is what creates unique, same-tick inter-block reaction surfaces.

1.2 MEV

MEV refers to the additional profit a participant with influence over transaction ordering, inclusion, or censorship can obtain beyond posted tips and base fees. In transparent first-come, first-served mempools, this influence generates a market for both order flow and order manipulation, while also creating incentives for censorship and chain reorganization. Foundational work formalized the role of priority gas auctions and highlighted the consensus layer risks introduced by transaction-order dependencies on decentralized exchanges (Daian et al., 2019). Subsequent empirical analyses quantified the magnitude of MEV opportunities across arbitrage, liquidations, and sandwich trading (Qin et al., 2022; Zhou et al., 2020). On sequential blockchains, MEV arises primarily through ordering control (such as front-running, back-running, and sandwiching), censorship of rival or victim transactions, and opportunistic history revision through reorganization or time bandit attacks (Carlsten et al., 2016). While MEV can occur both within and across blocks, the existing literature has largely focused on intra-block mechanisms. In all cases, MEV imposes externalities on both users and the underlying protocol. Private order flow channels and order flow auctions (OFAs) attempt to rebate value to users and reduce public mempool exposure but also raise centralization concerns (Lu, 2024; Gupta et al., 2023). Orthogonal lines use fair ordering consensus to constrain how much advantage ordering control yields (Kelkar et al., 2020; Kelkar et al., 2023; Cachin and Micic, 2023). Another direction is encrypted mempools to hide payloads until commitment, reducing same-tick informational edge (Choudhuri et al., 2024; Lührs et al., 2025).

2 MEV in MCP

MEV in sequential blockchains has been well studied in the literature, and a number of proposals have been made to limit MEV. In this work, we isolate some MCP-specific externalities arising from concurrent proposal and deterministic merge ordering that have no analog in sequential single proposer chains. MEV in sequential blockchains can take many forms but is most frequently seen in the form of censorship, front-running, back-running, or sandwich attacks. These attacks are typically considered to take place within a single block, although some work has studied MEV across sequential blocks. Such attacks continue to exist in an MCP blockchain, and the strategy space remains unchanged for both tx-issuing agents and proposers attempting to extract MEV. Atop the more traditional scope of MEV, the use of an MCP protocol introduces several novel types of MEVs that are either limited in scope or non-existent in sequential blockchains. Table 1 summarizes where these MCP specific channels arise across the Sei Giga style pipeline.

TABLE 1. Where MCP-specific MEV channels arise in a Sei Giga-style pipeline.

Though trivially present in a sequential blockchain, it is worth briefly discussing censorship in the context of MCP. Once a transaction is received, the proposer can arbitrarily choose whether to include any given transaction. If the proposer chooses not to include a transaction, they lose the tip for that transaction but gain whatever expected utility the censorship gave them. A Sei Giga-style MCP protocol offers probabilistic censorship resistance, however, because any agent can issue any transaction multiple times for inclusion. Therefore, the proposer is acting in a state of incomplete information, as the utility gained from censoring may be lost if another proposer has the transaction and includes it in the same tick of the system.

In a traditional sequential blockchain, mempools exist, and gossip transactions ensure all proposers have access, at least ignoring private mempools, to the same set of transactions from which to build their block. Sei Giga has no mempool. This means a transaction may be known by only a single proposer who is able to auction off that transaction to another proposer who may have the ability to extract some MEV-style side utility from said transaction. Once a block is published on the DD layer, its content is available for the public to see. If another proposer who sees the block sees a transaction they can extract utility from, either in expectation of their version of the tx being executed first, giving them the tip, or via MEV, then they have an incentive to include that transaction in their own block.

Assume two users intend to bid on the same asset, but User 2 knows they have access to a faster block publisher. User 2 is able to wait for User 1 to submit their bid and for that block to be published on the DD layer before User 2 submits their bid. In a sequential blockchain, a similar game is possible at the mempool level. However, ensuring User 2’s transaction is included first in the block requires a side payment to an arbitrary block builder, or a high tip and the hope that the tip acts as an ordering auction allowing that transaction to be included first. No such payments are required in MCP if it is known that the block will be included in the same tick of the system, after which ordering is deterministic.

The traditional MEV strategies from sequential models are extended in the MCP model to extend over multiple blocks in the same tick of the system. As such, it is possible to attempt to perform an MEV game against a transaction in another block once it is public on the DD layer. Spam comes in many forms, but we focus on two channels in this work, namely, DoS-style use of the DD layer and attempts to gain access to the front of the merged block through spamming transactions.

3 A model of MEV

We use the following notation throughout this work.

Table 2.

Let F x ( α ) = A ( 1 − e − k α ) be gross MEV accrual and let S x ( α ) = e − λ α be the survival. Then, and the per-tx objective for delay α ≥ 0 is U m e v ( α , τ x ) = Δ x ( α ) + τ x e − λ α . We adopt a single hazard λ > 0 that governs both the survival of an opportunity against pre-emption and the effective discounting of the tip. As such, the tip is realized only if x survives until execution. Hence, the expected tip conditional on delay α is τ x S x ( α ) = τ x e − λ α. Additional time discounting over sub-second ticks (∼300 ms) is negligible relative to pre-emption risk, and inventory/credit frictions for proposers at this horizon are second order.

Δ x α = ∫ 0 α A k e − k s S x s d s = A k k + λ 1 − e − k + λ α ,

Assume a set of proposers P = { 1,2 , … , n }. Let time be divided into discrete ticks T = 1,2 , …. We define a transaction x as having a true bid f x and a tip τ x. For proposer i in tick t, let X i t be the set of transactions it has received and let B i t ⊆ X i t be the (multi)set of transactions it actually includes in its PoA-certified blocks during tick t.

We take a block-building baseline in which all transactions are included immediately:

u build t , i B i t = ∑ x ∈ B i t τ x .

Upon receiving a transaction x, proposer i chooses a delay α x ≥ 0, where α x = 0 is immediate inclusion, and α x > 0 harvests MEV. We allow a different delay for each transaction and collect these into a vector:

α t , i = α x x ∈ B i t .

For a single transaction x, the expected MEV from delaying by α x isand the expected tip conditional on survival is τ x e − λ α x. Thus, the per-transaction payoff from choosing delay α x is

Δ x α x = A k k + λ 1 − e − k + λ α x ,

u x α x ≔ U m e v α x , τ x = Δ x α x + τ x e − λ α x .

The side (MEV) component for proposer i in tick t iswhile the realized tip component is

u mev t , i B i t , α t , i = ∑ x ∈ B i t Δ x α x ,

u tip t , i B i t , α t , i = ∑ x ∈ B i t τ x e − λ α x .

We note that U m e v ( α , τ x ) is a per-transaction payoff combining both the MEV component Δ x ( α ) and the hazard discounted tip τ x e − λ α. At the block level, we will sometimes refer to the pure-MEV component u m e v t , i ( B i t , α t , i ) = ∑ x ∈ B i t Δ x ( α x ) , which, unlike U m e v, does not include tips.

Putting these together, the total utility of proposer i in tick t is

U t , i B i t , α t , i = ∑ x ∈ B i t u x α x = u mev t , i B i t , α t , i + u tip t , i B i t , α t , i .

Immediate inclusion is α x = 0 because U m e v ( 0 , τ x ) = τ x. To avoid clutter, we will usually suppress the arguments and simply write U t , i. For a single transaction with tip τ x, the proposer’s one-dimensional delay problem isand we define the per-tx delay envelopewhich depends on x only through its tip τ x and the MEV parameters ( A , k , λ ).

max α ≥ 0 U m e v α , τ x ,

M τ ≔ sup α ≥ 0 U m e v α , τ ,

3.1 Censorship

We will now model censorship in MCP from the perspectives of a transaction issuing agent, the user, and the proposer, following Fox et al. (2023). Upon receiving a transaction x, the proposer faces four strategic options. It may include immediately, yielding utility u i n c = τ x, drop it entirely for a side payment β, yielding u d r o p = β, delay inclusion to extract MEV over a time window α, obtaining u k e e p ( α ) ≔ U m e v ( α , τ x ) = A k k + λ 1 − e − ( k + λ ) α + e − λ α τ x ;, or hold it for a proposer-to-proposer auction, where each of the m = | P | − 1 rival bidders j has valuation V j x ( α ) = max e − λ α τ x + Δ x , j ( α ) , β j , and the seller’s expected revenue under the optimal auction with regular i.i.d. values F α is u a u c ( α ) = R e v * ( α ) ,, as established in Proposition 2 (in general R e v * ( α ) ≠ E [ max j V j x ( α ) ]).

Lemma 1 (Drop vs. keep cutoff). Let U m e v ( α , τ ) = A k k + λ 1 − e − ( k + λ ) α + τ e − λ α and define M ( τ ) ≔ sup α ≥ 0 U m e v ( α , τ ). Then M ( τ ) is continuous and strictly increasing with M ( 0 ) = A k k + λ and lim τ → ∞ M ( τ ) = ∞. Hence there exists a unique cutoff τ d ≥ 0 solving M ( τ d ) = β. The optimal proposer policy iswhere α ⋆ ( τ ) equals 1 k ln A k λ τ if τ < A k / λ and 0 otherwise. If β ≤ M ( 0 ) = A k k + λ, then τ d = 0, and no drop region exists.

Proof. For fixed τ, U m e v ( α , τ ) is continuous and unimodal in α with at most one interior maximizer (Lemma 3), sois finite for all τ ≥ 0. At τ = 0, we havewhich is strictly increasing in α and converges to A k k + λ as α → ∞; hence, M ( 0 ) = A k k + λ .

M τ = sup α ≥ 0 U m e v α , τ

U m e v α , 0 = A k k + λ 1 − e − k + λ α ,

For τ 2 > τ 1 ≥ 0 and any fixed α ≥ 0,so U m e v ( α , τ ) is strictly increasing in τ pointwise in α. Let ε > 0 and choose α ε such that U m e v ( α ε , τ 1 ) > M ( τ 1 ) − ε . Then,

U m e v α , τ 2 − U m e v α , τ 1 = τ 2 − τ 1 e − λ α > 0 ,

M τ 2 ≥ U m e v α ε , τ 2 = U m e v α ε , τ 1 + τ 2 − τ 1 e − λ α ε > M τ 1 − ε .

Because ε is arbitrary and the increment ( τ 2 − τ 1 ) e − λ α ε > 0, this shows that M ( τ ) is strictly increasing in τ on ( 0 , ∞ ). Moreover, M ( τ ) ≥ U m e v ( 0 , τ ) = τ, so lim τ → ∞ M ( τ ) = ∞.

By strict monotonicity and continuity of M ( τ ), its range on 0 , ∞ is M ( 0 ) , ∞ = A k k + λ , ∞. If β > M ( 0 ), there exists a unique τ d > 0 solving M ( τ d ) = β. If β ≤ M ( 0 ), then M ( τ ) ≥ β for all τ ≥ 0, and the comparison with the drop payoff β implies that DROP is never strictly optimal. In this case, we can take τ d ≔ 0, and the drop region is empty, as stated. The optimal proposer policy in terms of τ d and α ⋆ ( τ ) then follows directly from comparing β, M ( τ ), and the inclusion payoff τ.

Lemma 2 (Closed form of M ( τ )). Let r ≔ λ τ A k with k , λ > 0 . Then, In particular, M ( 0 ) = A k k + λ, and M ( τ ) is strictly increasing in τ.

Because U m e v ( α , τ ) → A k k + λ as α → ∞ and U m e v ( 0 , τ ) = τ, and because U m e v is unimodal in α (Lemma 3), the maximizer is either the interior point α ⋆ ( τ ) = 1 k ln A k λ τ when τ < A k / λ, or the boundary α = 0 when τ ≥ A k / λ. Thus, the immediate-inclusion threshold iswhich separates delay ( τ < τ † ) from immediate inclusion ( τ ≥ τ † ).

τ † = A k λ ,

Lemma 3 (Maximizer). Let α ⋆ ( τ ) denote any maximizer of U m e v ( α , τ ) . With U m e v ( α , τ ) = A k k + λ 1 − e − ( k + λ ) α + τ e − λ α and k , λ > 0 , Let r ≔ λ τ A k. Then if 0 < r < 1 (i.e., τ < A k / λ), there is a unique interior maximizerIf r ≥ 1 (i.e., τ ≥ A k / λ), the global maximizer is the boundary α ⋆ ( τ ) = 0 (immediate inclusion), and if τ = 0 ( r = 0 ), the maximizer is attained in the limit α ⋆ → + ∞ with value A k k + λ.

Proof. We haveso

U m e v α , τ = A k k + λ 1 − e − k + λ α + τ e − λ α ,

d d α U m e v α , τ = A k e − k + λ α − λ τ e − λ α = e − λ α A k e − k α − λ τ .

Because e − λ α > 0 for all α ≥ 0, the sign of the derivative is determined byLet z = e − k α ∈ 0,1. Then f ( α ) = A k z − λ τ is an affine function of z and strictly decreasing in α because z is strictly decreasing in α.

f α ≔ A k e − k α − λ τ .

If 0 < r ≔ λ τ / ( A k ) < 1, that is, τ < A k / λ, then the equation f ( α ) = 0 has a unique solution with z ⋆ = r, namely,For α < α ⋆ ( τ ), we have z > r and f ( α ) > 0, so U m e v is strictly increasing. For α > α ⋆ ( τ ), we have z < r and f ( α ) < 0, so U m e v is strictly decreasing. Hence, α ⋆ ( τ ) is the unique interior maximizer in this case.

α ⋆ τ = 1 k ln 1 r = 1 k ln A k λ τ > 0 .

If r ≥ 1, that is, τ ≥ A k / λ, then f ( 0 ) = A k − λ τ ≤ 0 and because f is strictly decreasing in α, it is nonpositive for all α ≥ 0. Thus d d α U m e v ( α , τ ) ≤ 0 for all α ≥ 0, and the global maximizer is at the boundary α ⋆ ( τ ) = 0 (immediate inclusion).

Finally, when τ = 0, we have U m e v ( α , 0 ) = A k k + λ 1 − e − ( k + λ ) α, which is strictly increasing in α and converges to A k k + λ as α → ∞. Thus, the maximal value is attained in the limit α ⋆ → + ∞ with value A k k + λ.

Lemma 4 (Symmetric cutoff). If every proposer uses the cutoff strategy with τ d from Lemma 1 , then no single proposer can profitably deviate. This is a best response.

Proof. Fix a transaction x with tip τ x and consider a single proposer i. Given our separable payoff specification, i’s decision on x does not affect the payoffs from other transactions. Other proposers’ strategies enter only through the common parameters ( A , k , λ , β ) already embedded in U m e v and M ( τ ).

For any τ x < τ d, the definition of τ d via M ( τ d ) = β and the strict monotonicity of M ( ⋅ ) in Lemma 1 imply M ( τ x ) < β. Because M ( τ x ) is the maximal payoff attainable by choosing any delay α ≥ 0, we have

sup α ≥ 0 U m e v α , τ x = M τ x < β .

Thus, the payoff from any inclusion/delay choice is strictly less than the drop payoff β, and the unique best response of proposer i on such a transaction is to choose DROP.

For any τ x ≥ τ d, we have M ( τ x ) ≥ β, so dropping is never strictly better than keeping, and the best attainable payoff is M ( τ x ) itself. By Lemma 3, this is achieved by choosing α ⋆ ( τ x ), which is the unique interior maximizer when τ x < A k / λ and equals 0 (immediate inclusion) when τ x ≥ A k / λ. Thus, conditional on deciding not to drop, α ⋆ ( τ x ) is the optimal delay choice.

Because the payoff from x to proposer i does not depend on how other proposers treat x beyond the common parameters already encoded in U m e v and M ( ⋅ ), the above argument applies transaction by transaction and independently of others’ actions. Hence, when every proposer uses the stated cutoff strategy, no single proposer can profitably deviate on any transaction x, and the strategy is a best response.

Users are impatient. Utility is v > 0 if included in this tick and 0 otherwise. Let the contacted proposer set be P s ⊆ P with size s = | P s |. For i ∈ P s, let censor probability be p x i ∈ 0,1. One broadcast round to all of P s yields inclusion probability 1 − ∏ i ∈ P s p x i. If the user repeats this broadcast to the same P s for k ∈ N 0 rounds, with per-submission cost c > 0, then with Π ≔ ∏ i ∈ P s p x i,

U k = v 1 − Π k − k s c .

Lemma 5 Let Q ∈ 0,1 and s = | P s | . For k ∈ N 0 , write If v ( 1 − Q ) ≤ s c, then arg max k ∈ N 0 U ( k ) = { 0 }. If v ( 1 − Q ) > s c, define Then arg max k ∈ N 0 U ( k ) = { k * + 1 }.

Proof. RecallFor each k ≥ 0, the incremental gain from one additional broadcast isBecause 0 ≤ Π < 1, the sequence Π k is strictly decreasing in k; hence, Δ U ( k ) is strictly decreasing in k.

U k = v 1 − Π k − k s c , Π = ∏ i ∈ P s p x i ∈ 0,1 .

Δ U k ≔ U k + 1 − U k = v Π k − Π k + 1 − s c = v Π k 1 − Π − s c .

If v ( 1 − Π ) ≤ s c, then Δ U ( 0 ) ≤ 0, and by monotonicity, we have Δ U ( k ) ≤ 0 for all k. Thus, the sequence U ( k ) is non-increasing in k, and the unique maximizer is k = 0.

Now suppose v ( 1 − Π ) > s c. Then Δ U ( 0 ) > 0, and by strict monotonicity of Δ U ( k ), there exists a unique integer

k * = max k ∈ N 0 : Δ U k > 0 = max k ∈ N 0 : v Π k 1 − Π > s c .

For every k < k *, we have Δ U ( k ) > 0, so U ( k + 1 ) > U ( k ) and the sequence is strictly increasing up to k *. For every k ≥ k *, we have Δ U ( k ) ≤ 0, so U ( k + 1 ) ≤ U ( k ),, and the sequence is non-increasing thereafter. Thus ( U ( k ) ) k ∈ N 0 is strictly unimodal and attains its unique maximum at k = k * + 1, as claimed.

Thus, we can trivially see that despite the risk of censorship, as in sequential chains, the user in an MCP chain frequently has a best response that involves submitting the transaction multiple times for probabilistic censorship resistance. However, in the real world, the user is unlikely to know the true probability of censorship and must act on a simpler heuristic closer to k = ⌊ v c ⌋.

3.2 Tx stealing

We formalize the decision of a rival proposer j ≠ i to steal a transaction x that first appears publicly inside proposer i’s DD published block during tick t.

Let σ i t ( x ) ∈ [ 0,1 ] denote the stealability of x against i within the same tick, the probability that (i) j observes x early enough to get a valid PoA for a block containing a duplicate of x in tick t, and (ii) the canonical inter-block ordering executes j’s duplicate of x before i’s copy. Let ρ i t ( x ) ∈ [ 0,1 ] denote the probability that i’s block misses tick t, while j can still include x in t after seeing it. In that case, the duplicate from j executes, and j receives τ x with probability ρ i t ( x ).

Including a duplicate of x costs proposer j the shadow value of a marginal slot in j’s block during tick t, denoted ϕ j t ≥ 0. If ordering before i also enables an additional inter-block MEV gain on x, denote that incremental advantage by δ x ≥ 0.

Proposition 1 (Steal threshold). Fix a transaction x first revealed by proposer i in tick t . Let σ i t ( x ) ∈ [ 0,1 ] be the probability that both i and a rival j make tick t , but j ’s duplicate executes before i ’s; let ρ i t ( x ) ∈ [ 0,1 ] be the probability that i misses tick t while j still includes x in t . These events are disjoint by construction. Let ϕ j t ≥ 0 be j ’s shadow blockspace value and δ x ≥ 0 a same-tick inter-block MEV increment. Then j has a (weakly) profitable steal iff equivalently τ x > ϕ j t / ( σ i t ( x ) + ρ i t ( x ) ) − δ x.

Proof. Fix a transaction x first revealed by proposer i in tick t and a rival proposer j ≠ i. By construction, σ i t ( x ) is the probability of the event E 1 that both i and j obtain PoA in tick t and that the canonical ordering executes j’s duplicate of x before i’s copy. Likewise, ρ i t ( x ) is the probability of the event E 2 that i fails to make tick t, while j’s block with a duplicate of x does make tick t and is executed. These events are disjoint by definition.

If j attempts a steal by including a duplicate of x in her block, she pays the opportunity cost ϕ j t ≥ 0 (the shadow value of the blockspace slot). Conditional on E 1 ∪ E 2 occurring, j receives the posted tip τ x plus any incremental inter-block MEV advantage δ x, for a total prize of τ x + δ x. On the complement of E 1 ∪ E 2, either x is not executed first from j’s block in tick t or j misses the tick entirely, and no prize is obtained.

Thus, the expected net payoff from attempting the steal is

Pr E 1 ∪ E 2 ⏟ = σ i t x + ρ i t x τ x + δ x − ϕ j t = σ i t x + ρ i t x τ x + δ x − ϕ j t .

This is (weakly) positive if and only ifwhich yields the stated condition. Solving this inequality for τ x yields the equivalent cutoff τ x ≥ ϕ j t / ( σ i t ( x ) + ρ i t ( x ) ) − δ x .

σ i t x + ρ i t x τ x + δ x ≥ ϕ j t ,

If multiple rivals may steal, the game becomes an all-pay contest for the unique prize τ x + δ x (Baye et al., 1996; Tullock, 1980).

Lemma 6 (Symmetric mixed equilibrium of steal attempts). Let there be m ≥ 1 potential thieves with identical parameters ( σ , ρ , ϕ ) and prize R ≔ τ x + δ x. Suppose each thief who attempts pays cost ϕ (consumes a slot) and, if n ≥ 1 thieves attempt, the winner is selected uniformly from the n attempters (others’ duplicates are pruned). Then there exists a unique symmetric mixed equilibrium (Baye et al., 1996) in which each thief attempts with probability p * ∈ [ 0,1 ] characterized by g ( p * ) = ∑ n = 0 m − 1 m − 1 n ( p * ) n ( 1 − p * ) m − 1 − n ( σ + ρ ) R n + 1 − ϕ = 0 . Moreover, p * is increasing in R and in ( σ + ρ ) and decreasing in ϕ and m.

Proof. Given that each of the other m − 1 thieves attempts independently with probability p, the number of opponents who attempt is N ∼ B i n ( m − 1 , p ) . The expected payoff for anyone who attempts iswhich yields the function g ( p ) in the lemma.

E σ + ρ R N + 1 − ϕ = σ + ρ R E 1 N + 1 − ϕ ≕ g p ,

The distribution of N is stochastically increasing in p, and the function n ↦ 1 / ( n + 1 ) is strictly decreasing in n, so E [ 1 / ( N + 1 ) ] is strictly decreasing in p. It follows that g ( ⋅ ) is continuous and strictly decreasing in p withHence, if ( σ + ρ ) R ≤ ϕ, then g ( p ) ≤ 0 for all p, and the unique best response is p * = 0 . If ( σ + ρ ) R ≥ m ϕ, then g ( p ) ≥ 0 for all p, and the unique best response is p * = 1. Otherwise, there is a unique interior p * ∈ ( 0,1 ) solving g ( p * ) = 0. Monotone comparative statics in R, ( σ + ρ ), ϕ, and m follow directly from this characterization.

g 0 = σ + ρ R − ϕ , g 1 = σ + ρ R / m − ϕ .

Corollary 1 (Anti-steal via equal tip-splitting). If duplicates of x that appear in tick t (the original plus n thieves) split the tip equally, the per-copy prize is R n = τ x / ( n + 1 ) . For any ϕ > 0 , there exists n ̄ such that for all n ≥ n ̄ , R n < ϕ, and stealing is strictly unprofitable.

Proof. Immediate from R n = τ x / ( n + 1 ) and the single agent threshold in Proposition 1.

In sequential chains, the analogous strategy requires being (or bribing) the sole block builder for the height. MCP exposes x on DD before final ordering, creating a same-tick duplicate race that is weak or absent in sequential settings. If same-tick incremental MEV δ x exists, the conclusion holds either when δ x = 0 or when the mechanism splits δ x proportionally across duplicates. Let m x denote the multiplicity of a logical transaction x across B t in tick t (counting all PoA certified copies revealed before the tick boundary). Execute only one copy of x but split the posted tip evenly across all m x in tick copies. Each proposer of a copy receives τ x / m x. This preserves the correct state while implementing the equal-split payoff used in Corollary 1.

3.3 Tx auctions

A proposer i who privately observes x (no global mempool) may sell access to x before the DD reveal. There are m ≥ 1 bidders j ∈ B = P \ { i }. Fix delay α ≥ 0. Each bidder’s payoff iswhere Δ x ( α ) is the MEV accrual from with parameters ( A , k , λ ). We assume i.i.d. regular values, V j x ( α ) ∼ F α with density f α on [ 0 , v ̄ α ] and increasing virtual value ϕ α ( v ) = v − 1 − F α ( v ) f α ( v ).

V j x α = e − λ α τ x + Δ x α ,

Proposition 2 (Myerson reserve under i.i.d. values). Under the i.i.d. regular assumption, the revenue-maximizing one-shot auction at delay α uses reserve r * ( α ) satisfying ϕ α ( r * ) = 0. The expected revenue equals

Proof. Fix α and consider the one-shot sale of access to x at delay α. Each bidder j ∈ B has value V j x ( α ) ∼ F α with density f α on [ 0 , v ̄ α ], and these values are i.i.d. and regular in the sense that the virtual valueis increasing in v.

ϕ α v = v − 1 − F α v f α v

Myerson’s optimal auction theorem (Myerson, 1981) states that for such a single parameter i.i.d. environment, the expected revenue of any incentive compatible mechanism equals the expected virtual surplus,where x j ( V ) is the allocation probability to bidder j as a function of the value profile V = ( V j x ( α ) ) j ∈ B. The revenue-maximizing mechanism chooses the allocation rule that maximizes this virtual surplus pointwise. Under regularity, this is achieved by awarding the good to the bidder with the highest value V * = max j ∈ B V j x ( α ) whenever the corresponding virtual value is nonnegative and not selling otherwise. This is implemented by a simple auction with a reserve price r * ( α ) satisfying ϕ α ( r * ) = 0. If V * ≥ r *, the highest bidder wins; otherwise, the seller keeps the good.

E ∑ j ∈ B ϕ α V j x α x j V ,

Under this allocation rule, the virtual surplus is max { ϕ α ( V * ) , 0 }, so the expected revenue iswith V * = max j ∈ B V j x ( α ), as claimed.

R e v * α = E max ϕ α V * , 0 ,

If V j x ( α ) ∼ U n i f [ 0 , v ̄ α ], then r * ( α ) = v ̄ α / 2, and for a second-price auction with reserve,

R e v * α = v ̄ α m − 1 m + 1 + 2 − m m + 1 .

Lemma 7 (Auction vs. internalization cutoff). Let M ( τ ) = sup α ≥ 0 U m e v ( α , τ ). The seller’s optimal action between {KEEP (choose α ≥ 0 ), AUC} is where R e v * ( α ) is the Myerson optimal expected revenue for the α-parametrized value distribution. Immediate inclusion is α = 0 inside M ( τ x ).

Proof. If proposer i keeps x and optimally chooses the delay α ≥ 0, her payoff isby definition of M ( ⋅ ). If, instead, she auctions access to x at some delay α, the optimal mechanism yields expected revenue R e v * ( α ), so the best attainable auction revenue is sup α ≥ 0 R e v * ( α ). Comparing the two actions KEEP and AUC therefore amounts to takingwhich is exactly the policy rule stated in the lemma. Immediate inclusion is the special case α = 0 inside M ( τ x ).

sup α ≥ 0 U m e v α , τ x = M τ x

arg max M τ x , sup α ≥ 0 R e v * α ,

Example 1 (Uniform i.i.d., explicit revenue). Let | B | = m ≥ 1 and V j x ( α ) ∼ U n i f [ 0 , v ̄ α ]. Then the virtual value is ϕ α ( v ) = 2 v − v ̄ α, and the Myerson optimal reserve is r * ( α ) = v ̄ α / 2. For a second-price auction with reserve r, the expected revenue isAt the optimal r * ( α ) = v ̄ α / 2,which strictly exceeds the no reserve revenue v ̄ α ⋅ m − 1 m + 1.

In MCP, bidders’ values typically differ via PoA rates μ j and reaction payoffs Δ x , j ( ⋅ ), violating i.i.d. regularity. Myerson still applies, but a simple mechanism is a posted reserve equal to the seller’s keep value at zero delay, r ≔ U m e v ( 0 , τ x ) = τ x. Sell access at price r to the first taker (or run a second-price auction with reserve r). When encrypted payloads remove Δ x , j, and bidders have identical deterministic values v ( α ) = e − λ α τ x, the optimal revenue equals v ( α ) via posted price. Hence, α = 0 maximizes revenue, and a posted reserve r = τ x is revenue equivalent to auctioning.

3.4 Timing games

Consider two users a , b who compete for an ordering-dependent surplus around the same on-chain object (e.g., an auction or an AMM arb). Let W > 0 and w ≥ 0 denote the first and second mover surpluses. Each user chooses a send time within tick t. After random latencies, their transactions appear on DD, and if a PoA is obtained before the tick boundary, they are jointly ordered by the protocol’s deterministic inter-block rule.

Let π u → v be the conditional probability that u executes before v in the tick. If b conditions on observing a’s DD publish before sending (the “wait-then-snipe” strategy), let ρ b ∈ [ 0,1 ] be the probability that b still makes it into tick t after observing, and let π b → a s n i p e be the conditional probability b executes before a under that strategy (typically π b → a s n i p e > π b → a if b is the faster publisher).

Proposition 3 (Best response to a reveal). If a transmits early in tick t so that b can observe a on data availability (DA), then b’s best response is to wait and snipe iffwith strict inequality for a strict preference (Budish et al., 2015).

Proof. Fix user a’s behavior in tick t so that b can observe a on DD before choosing between either sending immediately or waiting to snipe. We compare b’s expected payoffs under these two actions.

If b sends immediately (no waiting), both a and b are assumed to make the tick, and the within-tick ordering is governed by the baseline probability π b → a that b executes before a. In that case, b’s expected surplus is

u n o w = π b → a W + 1 − π b → a w .

If instead b waits to observe a’s DD publish and then attempts to snipe, then with probability ρ b, she still makes the same tick t, in which case the conditional probability of executing before a is π b → a s n i p e, and the expected surplus isWith the complementary probability 1 − ρ b, b misses tick t and, under the impatience assumption, receives zero in this stage. Thus, the expected payoff from waiting and sniping is

π b → a s n i p e W + 1 − π b → a s n i p e w .

u s n i p e = ρ b π b → a s n i p e W + 1 − π b → a s n i p e w .

The wait-and-snipe strategy is a (weakly) better response than sending immediately if and only if u s n i p e ≥ u n o w, that is,Strict inequality yields a strict preference. This is exactly the condition in the proposition.

ρ b π b → a s n i p e W + ρ b 1 − π b → a s n i p e w ≥ π b → a W + 1 − π b → a w .

Lemma 8 (Deadline effect). Suppose both users are impatient (zero value if not included in tick t ), and b has a strict same-tick ordering advantage π b → a s n i p e > 1 2 ≥ π b → a . Then there exists a last admissible send time s ̄ ∈ ( 0,1 ) (normalized tick window) at which b is indifferent between “send now” and “wait,” for any earlier time s < s ̄ at which a can be observed before s ̄ , b strictly prefers to wait. Hence, when both players are fast enough to make s ̄ , the unique subgame perfect equilibrium has a transmit at s ̄ and b wait to snipe at s ̄ + , creating a within-tick deadline race.

Proof. Let ρ b ( s ) be the probability that b still makes the tick if waiting to observe a at time s in the normalized tick window. By construction, ρ b ( s ) is continuous and strictly decreasing with ρ b ( 0 ) = 1 and ρ b ( 1 ) = 0. Define

h s ≔ ρ b s π b → a s n i p e W + 1 − π b → a s n i p e w − π b → a W + 1 − π b → a w .

The sign of h ( s ) determines whether b prefers to wait and snipe (when h ( s ) > 0) or to send immediately (when h ( s ) ≤ 0).

In the first-mover advantage regime W > w that underlies the timing game (the winner obtains strictly more surplus than the loser), we havebecause π b → a s n i p e > π b → a by assumption, andbecause W > w ≥ 0 and π b → a ∈ 0,1. By continuity of ρ b and hence of h, there exists a unique s ̄ ∈ ( 0,1 ) such that h ( s ̄ ) = 0. For any s < s ̄ at which a can be observed before s ̄, we have ρ b ( s ) > ρ b ( s ̄ ) and thus h ( s ) > 0, so b strictly prefers to wait and snipe rather than send immediately. For s > s ̄, h ( s ) < 0 and b strictly prefer to send immediately rather than wait further.

h 0 = π b → a s n i p e − π b → a W − w > 0 ,

h 1 = − π b → a W + 1 − π b → a w < 0

Backward induction on the within-tick time line then yields the claimed deadline structure such that when both players are fast enough to reach s ̄, a transmits at s ̄ and b waits to snipe at s ̄ +, generating a within-tick deadline race. In the degenerate region W ≤ w, the function h ( s ) is nonpositive for all s , and b never finds waiting strictly profitable. The timing problem collapses to sending as early as feasible, and no interior deadline arises.

Corollary 2 (Protocol-level mitigation). If the canonical inter-block ordering is tip priority with dependency constraints, increasing τ a increases a ’s effective π a → b and shrinks the waiting region in Lemma 8. In the limit where π b → a s n i p e cannot exceed π b → a (e.g., encrypted payloads before execution), waiting ceases to be optimal for b.

3.5 Inter-block MEV

Inter-block MEV arises when a proposer can craft transactions that condition on, or react to, transactions revealed on DD in other proposers’ blocks within the same tick. Let R denote a finite family of such reaction strategies (e.g., backruns, cross decentralized exchange (DEX) arbs, liquidations). For r ∈ R and a realized set of counterpart transactions Y revealed on DD before the tick boundary, let the incremental value of executing r at a given relative position be Δ r ( Y , pos ).

Let π r p r e ( Y ) (resp. π r p o s t ( Y )) denote the probability that r is executed before its triggering leg(s) under the canonical ordering, conditional on r and the triggers all making tick t. Write Π r ( Y ) ≔ π r p r e ( Y ) Δ r ( Y , pre ) + π r p o s t ( Y ) Δ r ( Y , post ) for the expected payoff of r given Y.

Lemma 9 (Additive decomposition). If the feasible reactions R do not share state conflicts (i.e., their execution sets are disjoint or commute under the block’s state transition), the total inter-block MEV for a proposer is

Proof. For each reaction strategy r ∈ R, let Z r ≔ 1 { r included } be the indicator that r is actually included in the block, and letbe its incremental payoff given the realized counterpart set Y. The total inter-block MEV can then be written as

X r ≔ Π r Y = π r p r e Y Δ r Y , pre + π r p o s t Y Δ r Y , post

∑ r ∈ R Z r X r .

Taking expectations and using linearity of expectation,

E ∑ r ∈ R Z r X r = ∑ r ∈ R E Z r X r .

Under the no conflict assumption in the lemma (execution sets are disjoint or commute), the inclusion decision for each r can be made independently of the payoff realizations of other strategies, and, in particular, we may treat Z r as independent of Y (and hence of X r). ThusSubstituting back yieldswhich is the claimed additive decomposition.

E Z r X r = E Z r E X r = Pr r included E Π r Y .

E ∑ r ∈ R Z r X r = ∑ r ∈ R Pr r included E Π r Y ,

Proposition 4 (Comparative statics in concurrency). With α * ( τ ; n ) = 1 k ( n ) ln ⁡ A + ln ⁡ k ( n ) − ln ⁡ λ ( n ) − ln ⁡ τ for the interior region A k ( n ) > λ ( n ) τ , In particular, at the boundary A k = λ τ (where α * = 0), More generally, α * increases in n whenever

Proof. Write k = k ( n ) and λ = λ ( n ) to simplify notation and defineOn the interior region A k ( n ) > λ ( n ) τ, the optimizer isDifferentiating with respect to n yieldsBecause g ′ ( n ) = k ′ ( n ) k ( n ) − λ ′ ( n ) λ ( n ), we obtainwhere k ′ , λ ′ are evaluated at n and we have suppressed the argument to lighten notation. Usingthis is precisely

g n ≔ ln ⁡ A + ln ⁡ k n − ln ⁡ λ n − ln ⁡ τ .

α * τ ; n = 1 k n g n .

d α * d n = g ′ n k n − g n k ′ n k n 2 .

d α * d n = 1 k n 2 k n k ′ k − λ ′ λ − g n k ′ n = − k ′ k 2 g n + 1 k k ′ k − λ ′ λ ,

g n = ln A k λ τ ,

d α * d n = − k ′ k 2 ln A k λ τ + 1 k k ′ k − λ ′ λ .

At the boundary A k = λ τ, we have ln ( A k / ( λ τ ) ) = 0, so the first term vanishes andat that point. More generally, away from the boundary, the sign of d α * / d n is governed by the inequalitywhich is the stated condition for α * to increase in n.

s i g n d α * d n = s i g n k ′ k − λ ′ λ

k ′ k − λ ′ λ ≥ k ′ k ln A k λ τ ,

Corollary 3 (Dominance region). There exists an n † such that for n < n † the censor/delay cutoffs from Lemma 1 are essentially sequential like, while for n > n † the incremental inter-block MEV increases M ( τ ) enough to expand the region where DELAY dominates INC.

3.6 Spam

We consider two spam channels, PoA spam to crowd the set of blocks that make a tick, and ordering spam to jump priority when the canonical execution order is tip priority with dependencies.

Each tick admits at most L PoA-certified blocks into consensus. Let an attacker submit s empty (or low value) blocks at per-block cost c D A > 0, increasing the chance that a victim block b with a valuable transaction x misses the tick. Let θ b ( s ) be the probability that b is excluded from the top L set due to congestion from spam s, with θ b ′ ( s ) > 0.

If the attacker stands to gain prize R x (e.g., by stealing x per Proposition 1 when b misses), the attacker’s expected profit is

Π s p a m s = θ b s R x − s c D A .

Lemma 10 (Minimal profitable spam). If θ b is differentiable and strictly concave, the unique interior optimum satisfies θ b ′ ( s * ) R x = c D A . In particular, a profitable attack exists iff max s ≥ 0 θ b ′ ( s ) R x > c D A . If θ b is piecewise linear (capacity cliff), then the minimal profitable spam is the smallest s that pushes b below rank L.

Proof. The attacker’s expected profit isIf θ b is differentiable and strictly concave on 0 , ∞, then Π s p a m is also strictly concave on 0 , ∞. Any interior maximizer s * > 0 must satisfy the first-order conditionand strict concavity guarantees that such an s *, when it exists, is unique. A profitable attack with some s > 0 exists if and only if max s ≥ 0 Π s p a m ( s ) > 0, which under θ b ( 0 ) = 0 is equivalent to max s ≥ 0 θ b ′ ( s ) R x > c D A.

Π s p a m s = θ b s R x − s c D A .

Π s p a m ′ s * = θ b ′ s * R x − c D A = 0 ,

If θ b is piecewise linear with a single capacity cliff at some s c l i ff, then θ b ( s ) is flat for s < s c l i ff and jumps when s crosses s c l i ff. For s < s c l i ff, we have θ b ( s ) = 0 and Π s p a m ( s ) = − s c D A, so spam is unprofitable. For s ≥ s c l i ff, the victim block b is pushed below rank L and θ b ( s ) is constant at its post-cliff value. The minimal profitable spam is then precisely the smallest s ≥ s c l i ff such that θ b ( s ) R x − s c D A > 0.

Suppose final execution within a tick uses tip priority, subject to dependencies. A user who wants to get ahead of a target transaction with tip τ * can submit K sacrificial transactions within the same tick with tips exceeding τ * to pull their critical transaction forward by K positions in the merged order (subject to dependency acyclicity). Let each sacrificial transaction cost base fee f > 0 (burned) plus the posted tip paid to some proposer (not rebated to the spammer).

Proposition 5 (Cost of tip priority ordering spam). Let the required overbid above the current kth order statistic tip be Δ k ≥ 0 for k = 1 , … , K. The minimal total private cost to advance K positions iswhile the private benefit is at most the incremental surplus gained from moving the target forward, denoted B K ≤ W. Ordering spam is privately unprofitable whenever C K > B K; in particular, if f is strictly positive, then beyond a finite K, the inequality holds regardless of Δ k.

Proof. Consider a user who wants to move a target transaction with tip τ * forward by K positions in the merged execution order. Under tip priority with dependencies, each sacrificial transaction used for this purpose must pay the base fee f and carry a tip strictly higher than the current frontier tip that it must beat. Let the minimal overbid above the current kth order statistic tip be Δ k ≥ 0 for k = 1 , … , K. Then the kth sacrificial transaction has tip τ * + Δ k and costs f + τ * + Δ k in total.

The total private cost of using K such sacrificial transactions is thereforeas stated. The private benefit from advancing the target forward by K positions is bounded above by the incremental surplus B K obtained from moving earlier in the queue, and by definition, B K ≤ W, the first-mover surplus. Ordering spam is privately unprofitable whenever C K > B K , because in that region, the net gain B K − C K is strictly negative. In particular, if f > 0, then C K grows at least linearly in K, while B K is bounded above by W, so beyond a finite K, the inequality C K > B K must hold regardless of the exact Δ k.

C K = ∑ k = 1 K f + τ * + Δ k ,

Corollary 4 Raising f (or charging for DD bytes that never execute Ethereum Foundation Core Developers (2022)) increases C K and shrinks the profitable region for ordering spam without affecting honest inclusion incentives (because f is burned).

3.7 PoA latency and inclusion

Fix tick t with residual time budget Δ i t > 0 between proposer i’s DD publish and the tick boundary. After DD publishes, i must collect ℓ ≔ f + 1 availability co-signatures. Model co-signer arrivals for i as i.i.d. exponential with rate μ i > 0. Then, the time to ℓ signatures isand the within-tick PoA success probability is

S i ∼ G a m m a ℓ , μ i shape ℓ , rate μ i ,

Pr P o A i in t = F Γ Δ i t ; ℓ , μ i = 1 − e − μ i Δ i t ∑ r = 0 ℓ − 1 μ i Δ i t r r ! .

Proposition 6 (Monotone effects of PoA rate). Pr [ P o A i in t ] is strictly increasing in μ i and in Δ i t . If a rival j has S j ∼ Γ ( ℓ , μ j ) independent of S i , then where p j = μ j / ( μ i + μ j ) and I is the regularized incomplete Beta function (Johnson et al., 1995).

If the ℓ co-signers have distinct rates μ i , 1 , … , μ i , ℓ, then S i is hypoexponential with a cumulative distribution function (CDF) given by a finite sum of distinct exponentials. The monotonicity in Δ i t and own rates still holds.

Corollary 5 (Link to stealability). Under the gamma race model with S i ∼ Γ ( ℓ , μ i ) and S j ∼ Γ ( ℓ , μ j ) independent, with f S j the Γ ( ℓ , μ j ) density and Pr [ S i > s ] = 1 − F Γ ( s ; ℓ , μ i ). Consequently, where p j = μ j / ( μ i + μ j ) and I is the regularized incomplete Beta function. Increasing μ i (or Δ i t ) decreases Pr [ S j < S i ] and thus tightens this bound on σ i t ( x ).

3.8 Multi-submission externalities

A user can submit the same transaction x to k ∈ N proposers in the same tick. Let the set of contacted proposers be P k = { i 1 , … , i k }, with per-proposer censor probabilities p x i r and PoA success probabilities π t i r = Pr [ P o A i r in t ]. Define effective inclusion probabilityEach submission incurs private wallet cost c > 0 and imposes a network externality e ( k ) ≥ 0 capturing additional DD bytes, gossip, and PoA congestion, with e ′ ( ⋅ ) > 0 and e ″ ( ⋅ ) ≥ 0.

Ψ k ≔ 1 − ∏ r = 1 k 1 − 1 − p x i r π t i r .

Definition 1 (Private and social objectives). For an impatient user with valuation v > 0 (utility only if included in tick t), the private objective is U p r i v ( k ) = v Ψ k − k c . Let η > 0 convert network externality to social cost units. The social objective is U s o c ( k ) = v Ψ k − k c − η e ( k ) .

Lemma 11 (Existence and uniqueness). If the per-submission success terms are weakly diminishing (i.e., the marginal gain Ψ k + 1 − Ψ k is strictly decreasing in k), then both problems admit a unique maximizer k p r i v and k s o c.

Proof. For the private problem, define the discrete increments

Δ k p r i v ≔ U p r i v k + 1 − U p r i v k = v Ψ k + 1 − Ψ k − c .

By assumption, the marginal gains Ψ k + 1 − Ψ k are strictly decreasing in k, hence the sequence ( Δ k p r i v ) k ∈ N 0 is strictly decreasing in k. The sequence ( U p r i v ( k ) ) k ∈ N 0 therefore increases as long as Δ k p r i v > 0 and decreases once Δ k p r i v ≤ 0, so it is strictly unimodal and has a unique maximizer k p r i v.

For the social problem,the discrete increments areThe convexity of e ( ⋅ ) implies that e ( k + 1 ) − e ( k ) is weakly increasing in k, so ( Δ k s o c ) k ∈ N 0 is again strictly decreasing in k. The same unimodality argument yields a unique maximizer k s o c for the social objective.

U s o c k = v Ψ k − k c − η e k ,

Δ k s o c ≔ U s o c k + 1 − U s o c k = v Ψ k + 1 − Ψ k − c − η e k + 1 − e k .

Proposition 7 (Pigouvian surcharge). At an interior solution, the first-order conditions are Thus k p r i v ≥ k s o c, and a per-submission surchargeimplements k s o c as the private optimum. If e ( k ) is smooth, the marginal surcharge ψ ( k ) = η e ′ ( k ) is sufficient.

Proof. For the private problem, the discrete marginal gain from increasing k to k + 1 isIn an interior optimum k p r i v (i.e., when the optimum is not at the boundary k = 0), the necessary and sufficient first-order condition for optimality in this discrete setting is

Δ k p r i v ≔ U p r i v k + 1 − U p r i v k = v Ψ k + 1 − Ψ k − c .

Δ k p r i v − 1 p r i v ≥ 0 , Δ k p r i v p r i v ≤ 0 .

For the social problem, the corresponding marginal gain isAt an interior social optimum k s o c, we similarly have

Δ k s o c ≔ U s o c k + 1 − U s o c k = v Ψ k + 1 − Ψ k − c − η e k + 1 − e k .

Δ k s o c − 1 s o c ≥ 0 , Δ k s o c s o c ≤ 0 .

Comparing the two marginal conditions, we observe that for each k because e ( k + 1 ) − e ( k ) ≥ 0 by monotonicity of e. Thus, the social marginal gain crosses zero weakly earlier in k than the private marginal gain. Equivalently, the k that solves the social first-order condition is weakly smaller than the one that solves the private first-order condition, so k p r i v ≥ k s o c.

Δ k s o c = Δ k p r i v − η e k + 1 − e k ≤ Δ k p r i v ,

To implement the social optimum via a Pigouvian surcharge, note that at an interior social optimum k s o c, we want the private problem with surcharge ψ k per submission to have the same first-order condition:evaluated at k = k s o c. Comparing with the social first-order conditionat k s o c shows that the required marginal surcharge at that point isIn other words, a per-submission surcharge ψ k = η e ( k + 1 ) − e ( k ) exactly internalizes the marginal externality at k and makes the private and social first-order conditions coincide. In a smooth approximation with differentiable e ( ⋅ ), this discrete difference is captured by the derivative ψ ( k ) = η e ′ ( k ).

v Ψ k + 1 − Ψ k = c + ψ k

v Ψ k + 1 − Ψ k = c + η e k + 1 − e k

ψ k s o c = η e k s o c + 1 − e k s o c .

When p x i r = p ∈ 0,1 and π t i r = π ∈ 0,1 are homogeneous, Ψ k = 1 − ( 1 − ( 1 − p ) π ) k and Ψ k + 1 − Ψ k = ( 1 − p ) π ( 1 − ( 1 − p ) π ) k, making the diminishing returns property explicit and the surcharge linear in k.

3.9 Inter-block ordering rule

Let B t denote the set of PoA certified blocks in tick t and let X t = ⋃ b ∈ B t b be the multiset of transactions revealed on DD. Each transaction x ∈ X t carries several attributes. It includes a tip τ x ≥ 0 in the style of EIP-1559, and a dependency set D ( x ) ⊆ X t, where the edges are required to form a directed acyclic graph. Each transaction is associated with an issuer proposer i ( x ), who has a publicly visible per-tick rank r i ( x ) t ∈ { 1 , … , n }, determined by a stake-weighted verifiable random function (VRF) over the epoch seed. Additionally, each transaction carries a DD timestamp t D A ( x ), which is monotone within the block, as well as a fixed tie-break hash h ( x ) ∈ { 0,1 } κ. We instantiate the fixed tie breaker as a nongrindable value, for example, h ( x ) ≔ V R F a ( x ) ( e p o c h _ s e e d ‖ ν ( x ) ) (or h ( x ) ≔ H ( s i g ( x ) )), so wallets cannot resample h to bias priority. Define the priority key π ( x ) and the partial order ⪯ by

π x ≔ lex τ x , − r i x t , − t D D x , h x , x ⪯ y ⟺ ∃ path x → y in the dependency DAG .

Definition 2 (Priority DAG merge scheduler (PDM)). Construct the dependency DAG G t = ( X t , E t ) with edges ( u → v ) for all u ∈ D ( v ). Initialize a max-heap H with all sources of G t keyed by π ( ⋅ ). Repeatedly: Continue until H = ∅. If cycles are detected, deterministically reject all transactions on any directed cycle (e.g., via a fixed tie break over vertex IDs) and continue. The remaining set is valid.

Theorem 1 (Determinism, feasibility, and monotonicity). Assume that G t is acyclic and that the tie-break hash h ( ⋅ ) is fixed and public. Under these conditions, PDM produces a unique total order consistent with ⪯, so that the outcome is a deterministic function of ( X t , τ , { r i t } , t D A , h ). The resulting order is a linear extension of G t, meaning that all dependency constraints are respected. Moreover, if the tip τ x of some transaction x is increased while all other fields remain fixed, and no new cycles are introduced, then x moves (weakly) earlier in the output order.

Proof. The first two properties follow from standard results on lexicographically keyed topological sorts with a fixed total tie breaker. The PDM algorithm is an instance of Kahn’s algorithm (Cormen et al., 2009). It repeatedly extracts an in-degree zero vertex from a priority queue keyed by π ( ⋅ ) and removes it from the DAG. When G t is acyclic, Kahn’s algorithm processes all vertices and outputs a linear extension of G t, that is, an order that respects all dependency edges. Because the priority key π ( ⋅ ) together with h ( ⋅ ) induces a total order on eligible vertices at each step, the output of PDM is unique, so determinism and feasibility follow.

For monotonicity in τ x, fix a transaction x and consider running PDM twice on the same DAG G t, once with the original tips { τ y } y ∈ X t and once with a strictly higher tip τ x ′ > τ x for x while keeping all other fields (including all other tips) unchanged. Before x becomes eligible (in-degree zero), its tip does not affect the algorithm, so the sequence of steps until eligibility is identical in both runs. From the moment x enters the heap on, its priority key π ( x ) is weakly higher under τ x ′ than under τ x, while the keys of all other eligible transactions are the same in the two runs. Thus, at any step in which x belongs to the heap in the original run, it cannot be extracted later in the modified run: increasing τ x can only cause x to be chosen earlier relative to other eligible vertices, never later. Eligibility itself is determined purely by G t and is therefore identical in the two runs. Consequently, the final position of x in the output order moves (weakly) earlier when τ x is increased.

Because π ( x ) gives lexicographic priority to higher τ x upon eligibility, PDM incentivizes “tip stacking” to pull a target forward (cf. Proposition 5). Mitigations include per-sender base fees (raising the marginal cost of sacrificial txs), duplicate-aware payouts (e.g., equal tip split across duplicates, cf. Corollary 1), and encrypt-then-order, which removes same tick informational gains. The PDM scheduler runs in O ( | X t | log | X t | + | E t | ) time with a binary heap. The t D D ( x ) used in the priority key is assigned by the DD layer at block publication (monotone within a block), not per-transaction by wallets. If the DD layer does not expose per-tx timestamps, drop the − t D D ( x ) component from π ( x ) . Determinism and feasibility still hold. To prevent wallets from grinding the tie-break hash h ( ⋅ ), we use a VRF proof tied to the sender’s fixed on-chain key and epoch: h ( x ) ≔ V R F a ( e p o c h ‖ ν ( x ) ) with on-chain verification. Fields entering h are not resamplable without changing the sender identity, thus h is non-grindable while remaining deterministic.

Corollary 6 (Effect on timing games and stealing). Under PDM, a faster PoA path increases − t D A and thus priority only when eligibility holds while increasing τ x always improves priority upon eligibility. Hence, compared to pure timestamp ordering, PDM compresses the benefit of “wait-and-snipe” ( Proposition 3) and increases the tip cutoff for profitable stealing ( Proposition 1) via the priority key.

4 Numerical illustrations

This section provides simple numerical illustrations of the article’s own primitives. The goal is not to claim an empirical measurement on a specific deployment but to validate the monotone comparative statics implied by the PoA-latency model and to show how these quantities feed into steal profitability cutoffs.

4.1 Within-tick PoA success as a function of ( ℓ , μ , Δ )

Recall S i ∼ Γ ( ℓ , μ i ) and Pr [ P o A i in t ] = F Γ ( Δ i t ; ℓ , μ i ). Table 2 reports F Γ ( Δ ; ℓ , μ ) for ℓ = 4 at a representative residual budget Δ = 0.5 (in normalized tick units). Higher μ sharply increases the chance that a block becomes eligible within tick t.

TABLE 2. Illustrative within-tick PoA success probabilities for ℓ = 4 and residual time Δ = 0.5 tick units.

4.2 PoA race win probability Pr [ S j < S i ]

Under independent gamma races with equal shape ℓ, Proposition 6 gives Pr [ S j < S i ] = I p j ( ℓ , ℓ ) with p j = μ j / ( μ i + μ j ). For ℓ ∈ { 3,4,5 }, if μ j / μ i = 2, then Pr [ S j < S i ] is approximately 0.79, 0.83, and 0.86, respectively. Figure 1 plots Pr[S _*j* < S _*i*] against the PoA rate ratio μ _*j*/μ _*i* for ℓ ∈ {3, 4, 5}, showing the closed form curves alongside Monte Carlo estimates (N = 50,000). Thus, even moderate PoA rate advantages translate into substantial same-tick ordering advantages, unless the protocol reduces the prize for being first (e.g., via duplicate-aware payouts) or removes the reaction surface (e.g., via encryption).

Figure 2 plots the full dependence on Δ, complementing the point values in Table 2.

4.3 Implication for stealing cutoffs

Proposition 1 shows stealing is profitable when ( σ + ρ ) ( τ x + δ x ) > ϕ. Because Corollary 5 bounds σ directly in terms of PoA race events, higher μ i (for the original publisher) reduces the bound on σ and therefore increases the tip required for profitable stealing. Conversely, duplicate-aware tip splitting reduces the effective prize by a factor equal to the in-tick multiplicity, collapsing the incentive even when σ is non-negligible.

In Figure 3, increasing observation and reaction latency from 0 to 0.4 tick units reduces σ + ρ from 0.524 to 0.447. Via Proposition 1, the stealing cutoff τ > ϕ / ( σ + ρ ) − δ therefore increases by about 17 % for fixed ( ϕ , δ ) (because 1 / ( σ + ρ ) increases from ≈ 1.91 to ≈ 2.24).

5 Quantitative comparison of mitigations under MCP

We compare MCP mitigations using the same primitives used throughout the article, stealability/miss probabilities ( σ , ρ ), same-tick incremental MEV δ, and the effective prize R paid for being the executed copy. The figures in this section are stylized numerical illustrations of the analytical model rather than empirical measurements from a live MCP deployment. Table 3 summarizes the levers each mitigation pulls and its primary tradeoff.

TABLE 3. Quantitative levers each mitigation pulls in the MCP primitives used in this article.

5.1 Residual profit expressions

For same-tick duplication/stealing, the baseline expected net gain of a thief isso a mitigation is quantitatively captured by how it reduces ( σ + ρ ), δ, or the prize.

Π s t e a l = σ + ρ τ + δ − ϕ ,

If m x in tick copies split the tip evenly, then the per-copy prize becomes R = ( τ + δ ) / m x, yieldingwhich collapses to negative as m x grows, even when ( σ + ρ ) is moderate.

Π s t e a l s p l i t = σ + ρ τ + δ m x − ϕ ,

If payloads are not observable until after the tick’s ordering is fixed, then the same-tick reaction value is suppressed ( δ ≈ 0 ), and the ability to construct a targeted duplicate after observing a victim becomes negligible (σ ≈ 0 for stealing as copying), making Π s t e a l approximately − ϕ.

PDM reduces metadata-only timing advantages by making tip priority the dominant lever upon eligibility, which increases the cost of winning ordering contests without requiring a centralized builder. Quantitatively, PDM acts by increasing the tip required to obtain a given ordering probability π u → v in the timing game, shrinking the “wait-and-snipe” region in Proposition 3.

6 Future work

Numerous open questions remain following this work, including the formalization of games not inherent in the MCP architecture noted here. Existing encrypted mempool designs apply directly. We conjecture that combining MCP with encrypted payloads can drive many of the new games we isolate down to some ϵ in expectation. Once payloads are hidden at the PoA stage, the economic viability of these games relies almost entirely on metadata or information side channels such as IP addresses. This work also intentionally avoided touching on TFMs beyond a simple EIP-1559-style fee rule, but a correctly priced TFM will be essential in addressing spam and multi-submission externalities.

7 Conclusion

MCP chains move MEV from a single builder’s private mempool to the same-tick inter-block races created by data availability before final ordering. Our hazard model with survival-discounted tips gives a compact delay inclusion envelope M ( τ ) and an immediate-inclusion threshold, clarifying how concurrency and PoA rates shape incentives to censor, delay, or duplicate transactions. Two protocol choices drive most of the mitigation. Duplicate-aware payouts that split tips across in-tick copies of the same transaction collapse duplication incentives and make private stealing unprofitable at realistic multiplicities. A deterministic priority DAG merge that orders by tip, proposer rank, and DD timestamp compresses latency races and, with a sensible basefee rule, increases the cost of ordering spam. Overall, MCP does not introduce unbounded new MEV; it shifts MEV into a domain the protocol can control. PoA rates govern stealability and the handling of duplicates, and within-tick ordering determines whether timing games pay out. Our timing games yield a same-tick analog of DeFi just-in-time (JIT) liquidity games.

Generative AI statement

The author(s) declared that generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Andrea Michienzi, University of Pisa, Italy

Reviewed by: Alexander Vladimirovich Bogdanov, Saint Petersburg State University, Russia

Xiaopeng Dai, China Academy of Industrial Internet, China