§ 03 REPORTS / ETHEREUM / 2026-07-14

The Auction Goes Dark: ePBS, Binding Bids, and the Price of Certainty

FILED UNDER ETHEREUM § 2026-07-14

How Glamsterdam's trustless payment channel reshapes the block auction — and why the fight between the protocol, the #1 builder, and the #2 builder is really a fight about who gets the last look. | July 2026

tl;dr

Table of Contents

  1. The Question at Hand
  2. How the Auction Works Today
  3. What ePBS Actually Changes
  4. The Supply Chain, Player by Player
  5. Three Arguments, Three Books
  6. The Maker's Problem: Why Spreads Widen
  7. The Empirics: What the Data Says Today
  8. Consequences, and the Right Question to Ask
  9. Sources

1. The Question at Hand

Three groups are arguing about what happens to Ethereum's block auction after Glamsterdam ships ePBS, and each has produced a self-consistent theory that happens to preserve its own position.

The protocol side (Potuz, Barnabé Monnot, and the broader EIP-7732 camp) says the auction goes sealed no matter what anyone does: once proposers can take payment trustlessly, the auction "becomes blinded no matter what we do." A June 2026 paper from Flashbots researchers — Bruno Mazorra, Minghao Pan, and Christoph Schlegel, Competing Auctions in Intermediated Markets, summarized on the Flashbots forum — formalizes this: a sealed first-price channel, merely by existing, pulls the winning bid out of any open or second-price alternative.

The challenger builder (Quasar, ~21% of blocks) says sealed bidding kills the entry ladder. Visible price discovery is how a flow-poor newcomer learns what blocks are worth and proves itself to orderflow providers: "if we didn't have open bids, no way you would finally have a 3rd major block builder now." Quasar spent March 2026 arguing that proposer authorizations — the spec detail that lets any builder serve a private bid safely — should be removed so bids stay open.

The dominant builder (Titan, via Gattaca's @mostlyblocks, in a July 13, 2026 X thread) says the trustless channel simply won't be used: "In-protocol bids will be less valuable than out-of-protocol bids… cancels are not possible for in-protocol bids… This exposes originators to adverse selection risks, so they'll bid less." In-protocol bids become "a back-up channel or floor bid," and their winning "an exception." Barnabé's reply conceded the core: "untrusted proposers would end up making less."

This report walks through the mechanics behind all three claims, checks them against the data we already have, and ends with the question the debate hasn't answered.

2. How the Auction Works Today

The defining feature of today's MEV-Boost auction is that openness is a structural byproduct of the middleman. Builders don't talk to proposers; they submit bids to relays, and relays run a public leaderboard anyone can stream. The price to beat is common knowledge in real time.

                    TODAY: MEV-BOOST (out-of-protocol, trusted)

  users/orderflow      searchers/makers        builders            relay             proposer
 ┌──────────────┐     ┌───────────────┐     ┌───────────┐     ┌───────────────┐     ┌─────────┐
 │ wallets,     │────▶│ bundles,      │────▶│ assemble  │────▶│ simulate bids │◀───▶│ calls   │
 │ RFQs, apps,  │     │ quote updates │     │ block,    │     │ PUBLIC top-   │     │getHeader│
 │ mempool      │     │ (cancellable) │     │ stream    │     │ bid feed      │     │ at t=?  │
 └──────────────┘     └───────────────┘     │ bids      │     │ escrows       │     └─────────┘
                                            │ CANCEL &  │     │ payload,      │
                                            │ REBID ok  │     │ enforces      │
                                            └───────────┘     │ payment       │
                                                              └───────────────┘
        openness = side effect of the relay        trust = the relay sees everything

Three properties matter for what follows:

Bids are revocable until the last instant. A builder streams ascending (or descending) bids continuously — relay data shows ~400 bid submissions per slot, with cancellation-by-lower-bid an explicitly supported relay feature. When the proposer's getHeader call finally arrives, the relay serves the top bid as of that moment. The builder's exposure to market moves is a few milliseconds of network latency.

The relay is a single clock. "Did the cancel arrive before the acceptance?" is trivially answered by one server with one timestamp. This is the relay's most underrated service, and the one hardest to replicate in consensus.

Proposer timing is already adversarial — but today it isn't an option against builders. Proposers choose when to call getHeader, and later is more profitable: MEV accumulates throughout the slot (timing games are a studied, professionalized strategy). Yet because bids stay revocable, a delaying proposer today merely harvests a fresher price — nobody is locked in. Hold that distinction: ePBS will change the payoff structure of this exact behavior without changing the behavior at all.

Add these up and today's auction hands the last look to the builder side, twice over: fast builders get a last look over rivals' bids (the pennying the public feed enables), and every builder gets a last look over the market (the cancellation right). The proposer is the passive leg of the trade. Keep both strands separate — ePBS treats them differently, and the debate's three factions are each really arguing about one of them.

3. What ePBS Actually Changes

EIP-7732 makes the builder a staked, in-protocol entity. A builder sends the proposer a signed bid: a commitment to a payload hash and a payment. If the proposer includes it, the protocol deducts the payment from the builder's stake — no relay needed for trust. The expected transport is direct: the proposer pings builders it knows; each replies point-to-point.

                POST-GLAMSTERDAM: TWO CHANNELS SIDE BY SIDE

                          ┌────────────────────────────────────────────┐
                          │  IN-PROTOCOL (trustless)                   │
              signed bid  │  • sealed by default (point-to-point)      │
        ┌──── builder ───▶│  • first-price by construction             │──┐
        │                 │  • BINDING: no cancels, stake-enforced     │  │
        │                 │  • needs staked balance ≥ bid              │  ▼
   searchers/                └────────────────────────────────────────┘ proposer
   makers                                                                picks one;
        │                 ┌────────────────────────────────────────────┐ only the
        └──── builder ───▶│  OUT-OF-PROTOCOL (relays, direct conns)    │ WINNING bid
                cancellable │ • cancellable, uncollateralized bids     │──┘ becomes
                bid stream  │ • open feed IF someone chooses to run it │    public
                          └────────────────────────────────────────────┘

Two shifts do all the work in the debate:

Privacy stops being a choice and becomes the default. Nothing in the protocol publishes losing bids. The only bid that ever becomes public is the winner's, on-chain. Openness now requires someone's deliberate, incentive-compatible effort — a proposer side-car forwarding bids, or a relay builders volunteer into. The Mazorra–Pan–Schlegel paper shows why that effort tends to unravel: whoever shows their bid while rivals hide theirs gets outbid by a hair, so hiding is dominant ("Game theory demands you must hide your bid," as Quasar itself put it). Their sharpest result: any second-price or bid-adjustment relay feature — Ultrasound's bid adjustment being the live example — collapses, because the relay can no longer observe the price it must beat. In last-look terms, sealing kills the first strand: the fast builder's look over rivals' bids dies with the feed that enabled it.

The last look changes hands. The second strand doesn't die — it reverses. A signed in-protocol bid is a binding IOU with no take-backs, valid across a window whose width the proposer controls — geography, client defaults, and deliberate timing games all vary when the decision lands. The bid is one-sided by construction: a builder can always top its own bid later, but never withdraw one. So if the market moves against the builder after signing, the proposer cashes the now-overpriced IOU; if it moves in the builder's favor, the builder just wishes it had bid higher. The builder is held to its bid exactly when the bid was a mistake — the textbook adverse selection of a firm quote held by a counterparty who moves last. The proposer, passive leg of today's trade, becomes the option holder; the same getHeader delay that today merely fetches a fresher price becomes an exercise window. This is the same free-option structure the research community flagged in ePBS's payload reveal (The Free Option Problem of ePBS), applied one layer up, to the bid itself — and note the payload-reveal option runs the other way, held by the builder, so ePBS distributes one option to each side of the trade.

The direction of this flip is certain; its magnitude is contested. Builders' countermeasure is to quote just-in-time — delay header responses so the signed bid is born fresh, pricing at response time rather than request time — while Potuz expects slot-timing design to cap the window. That arms race, previewed in the March thread, determines how much the option is worth. Titan's stated fix-that-won't-happen: in-protocol cancels "would need consensus on bid timing to be enforceable, which is excess load on attesters" — i.e., you'd need the validator set to agree on millisecond-level message ordering, the one thing a distributed consensus network is structurally worst at and the one thing a relay's single clock did for free.

4. The Supply Chain, Player by Player

Player Interface today Post-ePBS options Likely move
User / orderflow app Wallet → private RFQ/OFA or mempool Unchanged mechanically Follows execution quality; pays via spread if certainty degrades
Searcher (CEX-DEX arb) Bundles to builders; relies on builder cancels to manage non-atomic risk Same, but a builder locked into a signed bid can't reflect late cancels Prices adverse selection into payments to builders on the binding channel
Market maker / prop AMM Streams quote updates to high-win-rate builders (update certainty is the product) Certainty falls on any slot the binding channel can win Widens quotes; concentrates flow on the most-certain builder
Builder (dominant) Streams cancellable bids to relays; last-look via open feed Keeps flow out-of-protocol; leaves shaded floor bids in-protocol Preserve status quo rails (this is Titan's stated position)
Builder (challenger/new) Uses open feed for price discovery and reputation-building Sealed default removes the ladder; staking requirement adds capital cost Fights for open bidding (Quasar's stated position) or exits
Relay Trusted escrow + public auctioneer + single clock Payment role obsolete; survives as uncollateralized-bid service, distribution, block merging Converges toward builder-side infrastructure
Proposer (sophisticated) Delays getHeader (timing games); multiplexes relays Adds in-protocol pings; can hold binding bids as a free floor while shopping out-of-protocol Harvests the option; earns full price
Proposer (default settings) Vanilla MEV-Boost Vanilla ePBS path Receives the shaded floor bids; earns less (Barnabé's concession)

The last two rows are the quiet distributional story: the timing variance that forces builders to shade is generated by sophisticated proposers and paid for by unsophisticated ones.

5. Three Arguments, Three Books

The paper (protocol-adjacent): sealed is inevitable, and it's knife-edge. Beyond the unraveling result, the paper's most interesting theorem is a comparative static: a proposer prefers to leak slow builders' bids when several fast, latency-optimized builders compete for the last look — their competition bids the block up, with the slow-builder maximum acting as a stochastic reserve price. With only one dominant fast builder, leaking just invites a penny-over-the-top win, so the proposer prefers everything sealed. Sealed-with-credible-commitment earns the proposer the most of all — but commitment devices (TEEs, reputation-staked relays) are realistic for Coinbase and Lido, not solo stakers.

Quasar (challenger's book): the ladder matters more than the equilibrium. The paper holds the number of competitive builders fixed. Quasar's entire argument is that this number is produced by the auction format: a new builder starts with mempool scraps worth a fraction of an exclusive-flow block, and open bidding is how it learns market prices, occasionally overpays to win, and visibly accumulates the trust that attracts real flow. Quasar claims six-plus months of building at ~10% of top block value before flow arrived. Remove the public feed and that bootstrap path closes.

Titan (incumbent's book): the channel is a lemon and will price like one. Binding bids carry a risk margin that compounds upstream — searchers and originators also price the risk that their transactions get frozen into a stale commitment — so in-protocol bids are structurally lower, win rarely, and mostly punish default-settings proposers. Note what this argument does not do: it doesn't restore the public leaderboard. Sealed bidding doesn't need the in-protocol channel — authenticated direct proposer-builder connections (exactly what the issue #156 fight was about) deliver sealed bids over trusted rails too. Titan's argument marginalizes the payment feature while leaving the drift toward darkness intact.

In last-look terms, the three factions are arguing about different strands of the same flip: the protocol side treats the flip as inevitable, Quasar mourns the first strand — the feed and the entry ladder it carried — and Titan refuses to write the reversed second strand. Each argument is mechanically sound. Each conclusion preserves its author's position. That triangulation is the honest state of ePBS a few months before Glamsterdam.

6. The Maker's Problem: Why Spreads Widen

The least-discussed consequence is microstructural, and it's the one that reaches end users.

What on-chain makers and searchers actually buy from a builder is not blockspace — it's update certainty: the probability that a quote update or cancel sent in the next few hundred milliseconds is reflected in the next block. A maker's spread is priced off the pick-off window — how long a stale quote sits exposed to informed flow before it can be pulled. This is standard microstructure: spreads compensate for the length and variance of staleness (the logic of Budish–Cramton–Shim's sniping model, and the reason loss-versus-rebalancing scales with block time).

        THE OPTION WINDOW BECOMES THE PICK-OFF WINDOW

 slot start                                                     slot end
 ├────────┬───────────────────────────────┬─────────────────────────┤
 │        │                               │
 t=0      t=sign                          t=proposer decides
          builder signs                   (geography + timing games:
          BINDING bid;                    ~350ms median today,
          payload FROZEN                  1400–2200ms if optimized)
          │◀════════ free option ════════▶│
          │   market moves; maker's       │
          │   updates CANNOT enter        │
          │   the committed payload       │
          ▼                               ▼
   maker quote goes stale …        … and can be picked off

Today the chain is tight: maker streams updates → builder rebuilds and re-bids with cancels → relay serves the freshest block at getHeader. Exposure ≈ milliseconds. ePBS's binding bid breaks the middle link: once signed, the payload is frozen, and every update arriving afterward is locked out for a window the proposer controls. Both the mean and the variance of staleness rise — and makers price variance.

   proposer's free option ──▶ builder can't guarantee freshness
        ──▶ maker's pick-off window widens ──▶ maker widens spread
             ──▶ worse on-chain prices for takers and LPs
                  ──▶ flow concentrates on the most-certain builder
                       ──▶ builder concentration rises
                            ──▶ (per the paper) proposers prefer sealed

The FX market ran this experiment under the same name. "Last look" in FX is held by the liquidity provider, which is why it lets LPs quote tighter — they can reject toxic fills. Here the option is held against the liquidity chain: proposer against builder, builder against maker. An option held against the quoter always widens the quote.

Two qualifications keep this honest. First, the effect is conditional on the binding channel actually winning blocks; in Titan's equilibrium it rarely does, and spreads barely move — the cost shows up instead as the two-tier proposer market. But makers price tails: even occasional stale-payload wins add a fat-tailed staleness event that must be reserved against every block. Second, there's a countervailing force — under sealed bidding, incumbents can't predict when they'll win, which weakens exclusive-orderflow deals and could disperse flow (Quintus Kilbourn's argument). Which force dominates is the open empirical question.

7. The Empirics: What the Data Says Today

Every load-bearing claim above touches a measurable quantity. Here is what's already measured, and what it implies.

How much are cancellations actually worth? The canonical measurement is Neuder & Thiery's Bid cancellations considered harmful (May 2023, Ultra Sound + Flashbots relay data). Effective cancellations — a bid higher than the eventual winner, submitted before it — appeared in 9.5% of slots on Ultra Sound (269/2,846) and 12.1% on Flashbots (256/2,110). The median cancelled value was 0.07 ETH, the median effective cancellation landed ~510ms before slot start, and the median foregone value was ~0.97% of the winning bid — with the dominant use case being non-atomic CEX-DEX arbitrage, where a Binance price move can flip a bundle from profit to poison mid-slot. Read against Titan's argument: at the median, the cancellation option is worth about a percent — a real but modest shading margin. The tail is what matters. The March 12, 2026 CoW/Aave incident — a $50.4M collateral swap routed through a $73k pool, an MEV bot paying ~$34.3M to Titan while the Lido proposer received 568 ETH (~$1.2M), among the largest proposer payments on record, behind only the USDC-depeg block and the 2023 SushiSwap and Curve whitehat blocks (The Block; tx 0x9fa9…801f, block 24,643,151) — is exactly the block a builder could not have safely bid binding: a 16,000 ETH valuation resting on market conditions that could invert within the option window. Builders don't shade for the median slot; they shade for the tail, and the staking requirement compounds it (who keeps thousands of ETH staked in advance for the one-in-ten-year block?).

How wide is the option window? Timing-games data bounds it. Median winning bids arrive ~350ms into the slot, but dataalways' analysis (Feb 2024, Ultra Sound data) put the network-wide optimal getHeader delay at ~1400ms (worth ~8.5% extra execution-layer yield), with efficient operators (Kiln, P2P, Attestant) able to push ~2200ms for ~15%, while Coinbase's infrastructure caps it near 550ms. Relays now sell this as a product — Aestus' timing-games-as-a-service targets an 800ms getHeader return — and per-operator adoption is tracked publicly at timing.pics. The implication for ePBS: proposer-side delay is not noise, it's an optimized, professionalized strategy with second-scale magnitude. A builder signing a binding bid must assume the counterparty is playing it. The shading margin scales with exactly this dispersion — and note the distributional inversion: the operators generating the variance are the sophisticated ones who will stay on cancellable rails, while the discount falls on default-settings proposers.

How concentrated is the fast-builder set? The paper's open-vs-sealed flip hinges on this number. As of July 14, 2026 (relayscan.io, 7d): Titan 53.6%, Quasar 21.0%, BuilderNet 12.1%, Eureka 9.1% — top two ≈ 75%, top four ≈ 96%. Whether this counts as "several competing fast builders" (open bidding survives) or "one dominant builder plus a chasing pack" (sealed wins) is precisely the knife-edge. During the March CoW/Aave block, observers counted only four builders competitively bidding.

What's still unmeasured — the numbers to produce before Glamsterdam:

  1. Value-weighted cancellation worth. The 2023 study is slot-weighted and three years old. Recompute on 2026 data, weighted by block value: what fraction of builder margin does revocability protect, especially in the top decile of blocks? That single number prices Titan's risk-margin claim.
  2. The staleness curve. Using public relay bid streams: how much does a block's final value differ from the same builder's bid X ms earlier? The slope of value-at-staleness is the direct input to the shading margin — and to the spread effect.
  3. The certainty premium in maker quotes. Prop AMMs and RFQ makers already width-adjust by builder win probability. Their quoting parameters contain today's price of update certainty; that's the baseline ePBS would move.
  4. Proposer decision-time dispersion, per operator, from timing.pics-style data — the empirical width of the free option, by counterparty.

8. Consequences, and the Right Question to Ask

Pulling the threads together:

Bid adjustment dies; first-price ossifies. The clearest, least conditional consequence. Relays survive — as uncollateralized-bid escrows for tail blocks, distribution networks, block mergers — but not as auction designers.

The proposer market bifurcates. Sophisticated operators (institutional stakers, timing-game players, credible-commitment devices) keep full-price access; default-settings proposers get shaded floor bids. A protocol feature motivated by trustlessness for the small operator may, in equilibrium, pay them less.

Spreads inherit the option. To the extent binding bids win blocks, payload staleness widens on-chain spreads, and the premium on update certainty concentrates flow on the most-certain builder. The trustless channel swaps a trust cost (relays can steal or censor) for a microstructure cost (frozen payloads widen spreads). Nobody in the debate has priced the second cost against the first.

And the ratchet. The paper's own comparative static says open bidding survives only while several fast builders compete. Quasar's account says sealed bidding is what blocks new fast builders from emerging. Put together: any concentration shock — an exit, an acquisition — flips proposers to sealed, and sealed then prevents the re-entry that would restore competition. Sealed is an absorbing state. The paper calls the open path "narrow"; the dynamics suggest it is also one-way.

Which yields the question this debate should be forced to answer — the one to put to the paper's authors:

Your results hold the number of fast builders and the distribution of orderflow fixed, but both are produced by the auction format itself. Open bids are the entry ladder (Quasar's claim); sealed bids erode exclusive-flow deals (Kilbourn's counter). Endogenize entry and orderflow allocation: which force dominates — and once the auction goes sealed, is there any equilibrium path back?

Everything else — relay survival, proposer revenue, spread width, builder count — is downstream of that answer.

9. Sources

Drafted with Claude (Anthropic) as research and writing collaborator; all quotes and figures verified against the linked primary sources.