BTX: batch threshold encryption for practical encrypted mempools
Monad Foundation
@monad- Published on
- · 4 min read
BTX is a new batch threshold encryption (BTE) scheme by Category Labs. It makes encrypted mempools practical, which removes a major source of MEV: the ability to read transactions before they are ordered.
On public blockchains, pending transactions are visible before they are ordered. Anyone watching the mempool can see a trade coming and front-run, back-run, or sandwich it, and that is where a large share of the value extracted from users comes from. An encrypted mempool keeps transactions encrypted until they have been committed to a block, so no one, including the block proposer, can read them in time to react.
The open problem has been decryption. Transactions have to be revealed after ordering without trusting any single party to hold the key. Threshold encryption does this with a committee of servers that decrypt collectively, where no minority can decrypt on its own. Running it efficiently for a full batch of transactions every block, at blockchain speed, is what earlier schemes struggled with. BTX is built to do that.
What BTX does
BTX lets a committee decrypt a chosen batch of ciphertexts from a larger pool while the rest stay private. It has a set of properties that make it practical to run inline with consensus:
- Optimal ciphertext size. A BTX ciphertext is the same size as a standard ElGamal ciphertext — the shortest overhead possible.
- Epochless and collision-free. Users encrypt without pre-selecting a batch index or slot. That removes a coordination step and a censorship vector present in schemes that require users to claim an index in advance.
- Fast decryption. Under 1 ms per core per ciphertext, using the AVX implementation from the paper's authors.
- Work scales with the actual batch. Computation grows with the number of transactions actually being decrypted, so a small batch stays cheap even when the surrounding pool is large.
How it performs
The decryption procedure is FFT-optimized, costing O(B log B) group exponentiations and O(B) pairings for a dynamically chosen batch size B. The authors implement it in optimized C++ over the BLS12-381 curve with AVX-512 vectorization, and report roughly a 2× speedup over an optimized baseline — for example, about 598 ms to decrypt a batch of B = 512 on a single core, versus 1197 ms for the baseline.
BTX is joint work by Amit Agarwal, Sourav Das, Babak Poorebrahim Gilkalaye, Peter Rindal, and Victor Shoup at Category Labs. The full construction, security proofs, and benchmarks are in the paper.
Where BTX fits in MEV resistance
MEV at the protocol level comes from two places. One is reordering: a single block proposer can insert, drop, or reorder transactions to extract value. The other is pre-execution visibility: transaction contents can be read before they are ordered. An encrypted mempool addresses pre-execution visibility, keeping transactions sealed until they are committed so there is nothing to read in time to front-run.
BTX is what makes that pragmatic — a threshold encryption scheme fast and compact enough to run per block, inline with consensus. It is a concrete step toward Monad delivering MEV resistance alongside its performance.
Learn more
- BTX: Simple and Efficient Batch Threshold Encryption on IACR ePrint
- Video interview with Babak Poorebrahim Gilkalaye at Category Labs
- Category Labs announcement
About Monad
Monad is a high-performance, EVM-compatible Layer 1 blockchain built to power the financial layer of the internet. Fully EVM-compatible, Monad delivers 10,000 TPS, 400ms block times, 800ms finality, and near-zero fees, without requiring specialized hardware. The network runs on consumer-grade machines, supporting accessible participation and decentralized network operation: over 200 independently operated validators across 30+ countries and 55+ cities secure the chain today.