Protocol09
Security & privacy
What is public, and when
| Data | Before submission deadline | After reveal |
|---|---|---|
| Tender details, budget, deadlines | Public | Public |
| Bidder addresses and number of bids | Public | Public |
| Commitment hash | Public | Public |
| Bid amount | Hidden | Public (if revealed) |
| Proposal | Encrypted on IPFS | Decryptable (if revealed) |
| Winner and reason | — | Public |
What never leaves your browser before reveal
Your amount, salt and document key. They are not sent to the website's server, analytics or the RPC node; only the commitment and the encrypted proposal are.
Contract safeguards
- Every phase transition is checked against block time.
- Bond withdrawals use pull payments, checks-effects-interactions and a reentrancy guard.
- No event or view exposes an amount before it is revealed.
- Transactions are simulated before you sign, so most failures show a clear error without spending gas.
Limits to know
Bidder addresses, the number of bids and the size of each encrypted proposal are visible. Eligibility is not verified on-chain.
Hedgora documentation · Arc Testnet