Sealed votes today, public reveal on time.
Every vote on Encrypted Predictions is locked with drand timelock encryption. Nobody — not even the market creator — can peek before the deadline. When the moment arrives, the chain itself unlocks them all at once.
01 · A clock that drips fresh randomness
The drand beacon
drand is a public network of independent nodes that jointly produce a fresh random number every 3 seconds. Each output is called a round and carries a signature σ_R that anyone can verify against drand's public key.
The signature for a future round does not exist yet — nobody, including drand itself, can produce it ahead of time. That's the guarantee timelock encryption is built on.
02 · Encrypt now, the network decrypts later
Timelock encryption
Using only drand's public key and a future round number R, anyone can encrypt a message that can only be decrypted once σ_R is published. The math is BLS12-381 identity-based encryption (IBE) — treat it as a public-key cipher where the "identity" is the round.
On the wire the ciphertext is just U ‖ V ‖ W — three byte chunks. For a 9-byte plaintext (poll_id ‖ option) the whole ciphertext is exactly 114 bytes. No symmetric cipher in the loop — small, on-chain-friendly, deterministic to decrypt.
03 · From browser to tally without a trusted server
Your vote, end to end
When a market is created we pick a drand round to use as the unlock time. Every voter encrypts their choice locally and submits the ciphertext to the contract. Once the round passes, anyone can call draw_result— the contract verifies the drand signature and decrypts every ciphertext directly on-chain.
- Browser encrypts
poll_id ‖ option_idxfor round R. - Contract stores the ciphertext + the voter's stake.
- When round R fires, drand publishes σ_R publicly.
- Operator submits σ_R + winning option; contract decrypts on-chain and writes tallies.
No off-chain server holds keys. No "trusted decryptor". The contract itself runs the pairing check (e(U, sk) · W) and writes the tallies, so any node validating the block re-verifies the result.
No front-running
Votes can't influence each other because none of them are visible until reveal.
No herd bias
You can't see a leading option and pile on — you have to pick blind.
No key custody
The unlock key is produced by drand on a schedule. Nobody holds it.
On-chain verification
Every node that validates the block re-runs the pairing check, so tallies are tamper-evident.
Ready to try it?
Launch a market with a close time a minute or two from now and watch the full flow happen in real time.