a16z: From paper to chain, how is auction theory practiced?

Original Title: 《On Paper to On-Chain: How Auction Theory Informs Implementations》

Author: Michael Zhu, a16z

Compiled by: 老雅痞

Auctions are ubiquitous in cryptocurrency. From Maker collateral auctions to Flashbots' sealed bid block space auctions and NFT auctions on OpenSea, auctions apply to a variety of situations that require price discovery, liquidity, or scarce resource allocation, whether on-chain or off-chain.

However, alongside the vast (and growing) academic research on auctions, it is clear that we have only scratched the surface of what these mechanisms could offer on-chain—such as optimizing privacy, efficiency, buyer surplus, and other key design goals. Given the "explosion" of automated market maker (AMM) designs after Curve and Sushiswap in 2020—alongside the simultaneous explosion of third-generation blockchains—on-chain auctions seem poised for a similar evolutionary peak.

While auction formats have previously been loosely adopted (and constrained by) the technical limitations of blockchains, we are now beginning to see more novel designs that are particularly suited to blockchain. Following traditional market practices, this article primarily aims to bridge the gap between auction theory and practice: how do theoretical principles inform decision-making implementations? Conversely, how do on-chain implementations provide new directions for theoretical research? While theory can guide us toward certain auction designs, analyzing the implementation details from a theoretical perspective can also be intriguing.

We first compare four typical auction types along three axes: information disclosure, bidding strategies, and on-chain implementation considerations. Then, we will focus specifically on the sealed bid format, delving into the relatively unexplored implementation details that make them unique on-chain, and introduce our open-source Solidity implementation of a Vickrey auction—we hope others can use it as a reference and a foundation for further experimentation.

Brief Introduction to Auction Forms

We have previously discussed this with a16z crypto research partners (and Harvard Business School professors) Scott Kominers and a16z crypto research head (and professor at Columbia University) Tim Roughgarden. Utilizing their expertise in advising crypto protocols, they outlined the types of auctions and incentive designs—covering nuances of market clearing prices and Gas Wars.

However, to set some background for the implementations below: auction theory has historically revolved around four typical auction types, first classified by William Vickrey in 1961, and described here in the context of single-item auctions.

A snapshot of available auction designs off-chain. Source: Wikipedia

English Auction (Ascending): In an English or ascending auction, the auctioneer opens bidding at a reserve (minimum) price, and bidders gradually raise their bids until only one bidder remains willing to pay the current price, at which point the last bidder wins. This is the most common form of auction in popular culture and media, typically in the context of selling antiques, artworks, or uncut gemstones.

Dutch Auction (Descending): In a Dutch or descending auction, the opening price decreases according to a specified schedule. In a Dutch auction, the first bidder wins, and the auction ends immediately. Historically, multi-unit versions of Dutch auctions have often been used to sell large quantities of perishable goods, such as cut flowers, fish, or tobacco. Recently, the U.S. Treasury introduced Dutch auctions for securities (in 1974), and Google used a Dutch auction to sell its shares during its IPO in 2004.

Sealed Bid First Price: Each bidder submits a sealed bid to the auctioneer (e.g., in a sealed envelope). After all bids are submitted, the auctioneer privately reads them and announces the winner (the highest bidder). The winner then pays the amount they bid. Sealed bid first price auctions are typically used in real estate when a property attracts interest from multiple buyers.

Sealed Bid Second Price (Vickrey Auction): The namesake Vickrey auction is the same as the sealed bid first price auction, except that the winner pays the value of the second-highest bid. Despite having interesting theoretical properties, Vickrey auctions rarely appear on-chain (partly due to the difficulty of implementing sealed bids).

These four auction types have different properties and dynamics, which become more complex when translated into smart contract implementations (which we will detail later).

Comparing Auction Types by Information Disclosure

A more natural way to compare each auction type is through bid visibility (open bidding vs. sealed bidding). Even with all other conditions being equal, the varying visibility of bids can have profound effects on the dynamics and outcomes of auctions.

English and Dutch auctions are open outcry auctions, meaning that prices are verbally announced as they rise or fall, and bids (including their amounts) are public to all potential buyers. However, sealed bid auctions may adopt several different privacy modes:

• Final Public: All bids are made public after the auction ends.

• Public Price: Only the winning bid is made public, while other bids remain undisclosed.

• Completely Confidential: No disclosure of bids or winning prices.

These assumptions about bid visibility imply that auctions also differ in terms of information disclosure. Different auction forms reveal varying amounts of information about bidders' valuations (upper or lower bounds) at different stages of the process. In an English auction, bids effectively determine a lower bound on that bidder's valuation. Conversely, in a Dutch auction, the current price can be interpreted as an upper bound on all bidders' valuations. Sealed bid auctions only disclose information after the auction concludes.

Notably, Dutch auctions can possess qualities of both open auctions and sealed auctions. Single-item Dutch auctions have privacy attributes similar to those of public price sealed bid auctions (since the first bid wins, all other lower bids remain confidential). However, as we will see later, these attributes can change significantly when Dutch auctions operate on-chain.

Common Value and Private Value

Examining the sales of common value and private value goods in open and sealed bid auctions can provide another perspective for comparing these formats. In auctions for common value goods, the item has some intrinsic value shared among all bidders, but bidders may have different or incomplete information about that value. A typical example of common value, as described by Nobel laureate behavioral economist Richard Thaler, is a jar of coins being auctioned; no bidder knows the exact value of the items in the jar, but everyone has their own estimates. In auctions for private value goods, each bidder has a separate value for the auctioned item, independent of their peers. For example, in Web3, NFTs purchased purely for personal enjoyment (without intent to resell or expectation of future utility) are private value goods, while collateral from liquidating a Maker vault is a common value good.

At the same time, authors of another paper studying timber auction data found that sealed bid auctions "attract more small bidders, which can lead to higher revenue compared to open bidding." Notably, the authors found that these results could be explained by a private value model (where private value varies based on the characteristics of timber auctions, such as "differences in bidder costs and contract arrangements"), completely ignoring common value in their model. This suggests that sellers may benefit from choosing sealed bid auctions under varying bidder motivations, backgrounds, or intended uses of the items.

English auctions are useful in scenarios dominated by common value where price discovery is the goal— as mentioned earlier, bidders can adjust their strategies accordingly based on how others evaluate the item when bids are placed. In a study on reverse auctions in online labor markets, the authors found that while sealed bid auctions attracted more bidders, the results of open bid auctions led to better prices for buyers (or more buyer surplus). Analysis indicated that these differences "largely depended on the relative importance of the common value component of auctioned IT services (as opposed to private value)." In other words, the open bidding format allows bidders to dynamically recalibrate their understanding of the value of the service, which is often unclear at the start of the auction (competition).

In practice, auctions often exhibit a combination of common value and private value characteristics. The interplay between the characteristics of these goods and how auction forms (and when) reveal information has complex downstream effects on bidding strategies. This raises the question: can we formalize the concept of "simple" bidding strategies (I don't need to think too much about how others might bid); is there an optimal auction for such strategies?

Comparing Auction Types by Bidding Strategies

So far, there is a notable lack of analysis on Vickrey auctions among the four typical auction types. Careful readers may be surprised by the payment rules of Vickrey auctions: the winner pays the second-highest bid rather than their own bid. This seems counterintuitive. In contrast, English auctions end with the lowest bid that no other bidder is willing to meet; the winner has no incentive to bid further, even if their own valuation is much higher. In fact, both English auctions and Vickrey auctions have strong theoretical advantages over Dutch auctions and sealed bid first price auctions: Dominant Strategy Incentive Compatibility (DSIC).

Roughly speaking, this means that each bidder's utility-maximizing strategy is simply to bid according to what they actually believe the auction item is worth (in common value auctions, this is just the expected value of the item, conditioned on the bidder's information). For a deeper understanding, these lecture notes can serve as excellent introductory reading.

In first price auctions, there is no such advantageous bidding strategy. Bidders need to lower their bids below their valuations to achieve positive utility. Specifically, what they need to consider is how much they can save by bidding higher than other participants, which is a Bayesian game. Dutch auctions are strategically similar. To achieve positive utility, bidders must wait until the price drops below their valuation, but how long to wait after that threshold is another Bayesian game. Perhaps more surprisingly, the expected revenue of all four auction types is the same (under certain assumptions; see Theorem 1).

Despite the theoretical advantages of Vickrey auctions, they are rarely seen in practice. Why is this the case? In "The Lovely but Lonely Vickrey Auction," economists Lawrence Ausubel and Paul Milgrom provide several explanations. The authors note that although strategically equivalent, English auctions are intuitively easier for bidders to reason about than Vickrey auctions. This intuition is formalized in an apparent strategy proof mechanism, indicating that English auctions are not only DSIC but that truthful bidding is "obviously dominant."

To provide a real-world example, Google announced last year that a project for advertisers bidding on content ad space, AdSense—would shift from second price auctions to first price auctions, citing simplicity and alignment with other digital advertising ecosystems. Beyond these usability considerations, platforms like AdSense also take a trust-based stance when conducting second price auctions: by overestimating the second-highest bid, dishonest auctioneers might extract more from the winner.

While these concerns affect adoption, Vickrey auctions can find new use cases as they expand into new environments. In particular, public blockchains provide a trusted neutral platform that can help circumvent issues like dishonest auctioneers. This, combined with the diversity of potential on-chain applications, suggests that smart contracts can provide a uniquely effective testing ground for Vickrey auction mechanisms.

Comparing Auction Types by Implementation Considerations

Bringing auctions on-chain can sometimes present new challenges compared to their off-chain counterparts. In the following sections, we will explore the current landscape of on-chain auctions and implementation considerations for each auction type.

On-Chain English Auctions

Today, most on-chain auctions fall into the open bidding category (i.e., English auctions or Dutch auctions). This includes OpenSea auctions with rising prices, Maker collateral auctions, and Zora Auction House smart contracts.

Under OpenSea, bids are encoded off-chain messages representing bid values, signed by bidders. When potential buyers place bids, the OpenSea UI displays the bids to sellers and potential bidders. However, in Maker collateral and Zora auctions, bidders submit transactions to indicate their bids; then, the bid transactions escrow the bidders' collateral in the auction contract. Since this is an unconfused on-chain transaction, bids are essentially public—anyone can see what bidders have offered by viewing incoming transactions to the auction contract (whether in the public mempool or when they are included on-chain).

Overall, the dynamics of English auctions remain relatively intact when converted into smart contracts. A significant distinction is that on-chain bids incur Gas costs, which are factored into the actual bid value. Since gas prices fluctuate during the bidding period of the auction, bidders who might otherwise have the highest bid could be temporarily outbid due to expensive gas fees.

On-Chain Dutch Auctions

From facilitating NFT sales to rebalancing TokenSets (and various derivative variants like Gradual Duction Auctions and Variable Rate GDAs), on-chain Dutch auctions have gained significant traction. This popularity is well-founded—simple Dutch auctions are relatively easy to implement as smart contracts and only require two on-chain transactions (one for creating the auction and one for the first and only bid). Most importantly, it does not lock up bidders' funds, unlike other auctions with on-chain bids.

The dynamics of off-chain Dutch auctions depend on effective instant bidding. Dutch auctions end as soon as a bid is announced, and no further bids can be made. However, when conducted on-chain, there is a time lag between broadcasting a bid and including it on-chain, which can lead to some unexpected consequences. If the first bid is broadcast to the public mempool (rather than a private transaction pool like Flashbots), it may trigger a Gas War, with other potential buyers broadcasting bids with increasingly high gas prices. Thus, when the off-chain rising price auction of transaction orders exceeds the Dutch auction itself, the gas-adjusted price may suddenly spike.

The time dependency of the price decline mechanism also brings other drawbacks. Suppose there is a continuous price decay function; bidders must be online at the right time to bid at a specific price or set up a bot (e.g., using Gelato Network) to bid. Accidental (or malicious) network congestion coinciding with the broadcast of the first bid could lower the final settlement price, harming the seller's revenue. Worse, a DoS attack could cause legitimate winners to lose the auction.

On-Chain Sealed Bid Auctions, Proven by New Open Source Implementation

Utilizing off-chain bidding platforms (like OpenSea) can easily implement sealed bid auctions, but they require trusting the auctioneer (a) not to disclose any bids, (b) not to review any bids, and (c) to correctly determine the outcome of the auction. Ideally, smart contracts would facilitate auctions in a trustless manner while retaining some degree of bid privacy.

To demonstrate, we have open-sourced a Solidity implementation of an over-collateralized sealed bid auction at github.com/a16z/auction-zoo, as a single-item (ERC721) Vickrey auction priced in ETH. We considered three requirements for the sealed bid auction smart contract during implementation:

• Privacy: Bid values should remain confidential, meaning observers cannot infer values while bidding is ongoing. We allow some information leakage (e.g., revealing that bids are within a certain large range), but there should be a reasonable degree of ambiguity.

• Resistance to Review: This is typically achieved by publishing bids on-chain.

• Bid Commitment: Potential buyers should not be able to withdraw their bids. The winning bidder should be locked in to pay the settlement price, and similarly, the seller should be locked in to sell the item to the highest bidder (possibly subject to a reserve price).

First, regarding the first two requirements, we need to address the issue of publishing private bids on-chain. Commitment disclosure schemes apply to "final public" bids (when bid values are disclosed after the auction ends). Potential buyers can provide a hash commitment of their bids to the auction contract during the designated bidding period, rather than making public bids. Later, at the end of the bidding period, each potential buyer reveals their committed bid. When bids are announced, the smart contract can determine the winner. In our implementation, the hash commitment is calculated as keccak256(abi.encode(nonce, bidValue)) and passed to the function. For gas efficiency, we only store the first 20 bytes of this hash. After the bidding period ends, users call the commitBid and revealBid functions to check that the provided nonce and bidValue match the stored commitment.

When turning to the third requirement, we discovered more complexity. To ensure the winner pays, the smart contract must lock the bids. We could require bidders to send ETH to secure their bids—note that the commitBid function is payable and records how much ETH the user locked—but the ETH attached to these transactions is public and cannot be obscured; in "locking" bids, we lose privacy.

Fortunately, there is a simple way to support our idea: allowing (and encouraging) bidders to over-collateralize their bids, i.e., locking more ETH than the bid value itself requires. Since bids may be over-collateralized, observers can only know the upper limit of the bid value. Note that our function allows users to lock any amount of ETH in their commitBid transactions; at the end of the auction, any excess will be refunded to the winner (if collateral is insufficient, the bid will be ignored).

Unfortunately, this quick solution has a drawback: over-collateralization creates a direct trade-off between privacy and capital efficiency. The opportunity cost of locking up a large amount of funds may outweigh the marginal benefits, putting capital-constrained bidders at a disadvantage.

That said, as we continue to explore different approaches, over-collateralization serves as a useful benchmark. The evolution of this implementation may be particularly useful in settings where users might bid in numerous auctions and can reuse collateral across each auction. In such cases, the collateral will naturally be much larger than any specific bid in a given auction.

Can we find better on-chain solutions? While over-collateralization may be appropriate in some cases, the trade-offs between capital efficiency and bid privacy may present bidders with a tough decision: lock up more funds for stronger privacy or sacrifice some privacy to free up funds for use elsewhere. But as on-chain auctions continue to surge and build on previous work, we expect auction designers to choose more formats and implementations based on the trade-offs they are willing to make.