# Skin color independent robust assessment of capillary refill time

Raquel Pantojo de Souza<EMAIL_ADDRESS>George C. Cardoso
<EMAIL_ADDRESS>Departamento de Física, FFCLRP, Universidade de São Paulo, Av.
Bandeirantes 3900, Ribeirão Preto, SP 14040-901, Brazil

###### Abstract

Capillary refill time (CRT) is a method of measuring the peripheral perfusion
status through a visual assessment. We have developed a robust system to
measure CRT using a webcam (RGB) that monitors polarized light reflected on
the skin. The average image intensity changes exponentially in time after the
application of compression. The characteristic time constant we designated
polarized capillary refill time (pCRT). We tested the pCRT performance in
twenty-two healthy adult volunteers with different ages 37 $\pm$ 16, by
momentarily applying a low compression (7 kPa) to the forearm of the
volunteers. Results show positive behavior in conditions including; poor
perfusion, high and low concentration of melanin, anemic conditions, and
damaged skin. In 80% of unique measurements, the result is within $\pm$ 20% of
the expected pCRT.

###### keywords:

Capillary refill time , Peripheral perfusion , non-invasive monitoring ,

##  1 Introduction

Evaluation of the color of the skin is important for therapeutic and
diagnostic applications. Several studies related to the importance of color
perception in the skin; indicate the level oxygenation and peripheral
perfusion [1, 2, 3], auxiliary in diverse diagnoses, for example, venous
ulcers, and neuropathy diabetic [4, 5], and others. There are many techniques
for evaluating peripheral perfusion, including Capillary refill time (CRT) is
a method used to estimate peripheral perfusion status [6, 7]. CRT is defined
as the time required for a distal capillary bed to regain its normal color
after having received enough pressure to cause blanching [8, 9] of the skin
surface. This test is taken from the fingertip [10], the sternum [11], or the
sites on the forearm [12] or knee [13, 14].

Measurements of CRT have reported in other studies, in intensive care units,
such as shock [15], dehydration in children [16], and the evaluation of dengue
[17]. However, these studies obtained the time, with the traditional
measurement CRT. In this case, the evaluation relies on the manual time
estimate and is affected by external factors with, for example, the lighting
temperature [18] of the limb and the environment, the application pressure [9]
and duration are poorly standardized. Also, manual measurement of CRT relies
highly on the performance of examiners, and causes high variability in the
results [6, 19, 20]. These limitations influence the assessment of CRT for the
manual measurement were due to the lack of a gold standard.

CRT test is widely acknowledged of the most tests used to evaluate peripheral
perfusion [21, 22]. Although a lack of robustness in the CRT measurements can
significantly influence the measured time [6, 9, 21]. Previous studies have
relied on the CRT test involves the visual inspection, and manual time
measurement introduces intra and inter-observer variability [6, 9],
furthermore, little is known about how this affects measure CRT in dark-
skinned patients. Also, these studies used right compression in the skin
surface and impossibility measurement CRT in sensitive skin with low
compression [9]. To avoid these challenges, Blaxter et al. proposed the
automated CRT device that was studied using an optical assessment of diffuse
reflectance [12]. Other studies used to video cameras to CRT simulators for
personnel training [23]. However, these studies have not evaluated the dark-
skinned patients and high compression in the skin surface.

Therefore, the current study focuses in measure the CRT using video analysis
with polarized light. For that, forearm videos were used to make an image-
analysis to calculate the time taken for the forearm color to return to its
baseline state after released from compression. These procedures were
performed with polarized light and camera techniques for recording video. CRT
measurement was obtained in adult healthy volunteers with different photoypes
skin and low compression (7 kPa) to evaluate the precision and the
reproducibility of the technique.

The purpose of our study was to develop acquisition of the video analysis for
CRT using polarized light. Was designed this decay time pCRT (Polarized
Capillary Refill Time) because it comes from the image formed by polarized
light reflected from the skin’s surface.

##  2 Material and Methods

###  2.1 Study subjects

Twenty-two healthy adult people (Table 1) without a history of cardiovascular
disease participated in this study after passing a screening interview. The
studies were conducted following the Declaration of Helsinki and received the
approval of the Medical School Clinical Hospital Ethical Committee of the
University of São Paulo (CAAE 95342518.1.0000.5407, report number
3.046.098/FFCLRP). All participants provided written informed consent before
the initiation of the study procedures.

Table 1: Characteristics of volunteers without know heart problems. The reported values are in average standard derivation (SD). Body Mass Index (BMI), Aortic pressure: Systolic Blood Pressure (SBP), Diastolic Blood Pressure (DBP) and Heart Rate (HR). n=22 subjects (9 f, 13 m) | Mean |  $\pm$ SD
---|---|---
Age (years) | 37 | 16
Height (cm) | 172 | 11
Weight (kg) | 75 | 16
BMI (kg/$m^{2}$) | 26 | 5
SBP(mmHg) | 123 | 19
DBP(mmHg) | 77 | 13
HR(bpm) | 74 | 11

###  2.2 Apparatus and measurement

Volunteers remained seated in a comfortable position in a height-adjustable
chair and with the right hand resting on the right thigh while the experiments
performed on the left forearm. The acquisition performed at a controlled room
temperature 21 ∘C, as described by Pickard et al., after acclimatization of
the subject. All acquisitions realized in a dark room to ensure that only
polarization of light was being used.

We developed a device to produce skin blanching on the volunteer’s forearm
(Figure 1(a)) by applying pressure. The device has a cylindrical structure
terminated by a Teflon rounded end, that can smoothly slide inside a hollow
acrylic cylinder and can be gently set to rest on the volunteer’s forearm.
Teflon ending acts as a thermal insulator to prevent temperature changes in
the skin. Cylindrical weight has a circular area of contact with the skin of 4
cm2. The compress applied in the region of interest (ROI) of the volunteer’s
forearms at a position 9 cm from the wrist-hand line.

Figure 1:  a) This schematic drawing shows the support, front view (1)
Cylindrical weight standard 4 $cm^{2}$ tip by Teflon (2) for conducting the
surface test of contact with the subject’s forearm (3) Armrest. b) Image of
device,with the lighting (4) source and the video camera (5) with polarized P1
and P2, c) Image of the experimental, side view

A video camera (Logitech HD Pro-C910, 24 fps, resolution of 1280 x 720 pixels)
and the light source (LED Taschibra TKL 90 - 14 W, E27) was attached to the
fixture (Figure 1(b)). Was manually focused on the video camera on the ROI.
Was installed crossed circular polarizers in the light source (P1) and camera
(P2) to reject the specular reflection component of the skin [24] (Figure
1(c)). The LED lamp was on for 15 minutes before the start of each
acquisition. The volunteers remained seated for 10 minutes, monitored by an
Oximeter (Model CMS50D - USB), on the left index finger, with the arm
positioned at the heart level. After 10 s of video acquisition, the ROI was
compressed for 5 s [9, 25] by the cylinder exerting a pressure of 7 kPa. Five
repetitions were done for each volunteer, with a 1-minute rest between
measurements. Videos were processed in MATLAB (MATLAB 2015a, The MathWorks,
Inc., Natick, Massachusetts, United States). Some videos excluded from the
analysis because of the movement of the volunteers during image acquisition.

Figure 2: Image of a volunteer’s forearm with ROI region. a) During
compression, b) Change in skin color after release.

The main focus of this work was to calculate the time pCRT of images of the
forearm (Figure 2), during the color change after the pressure applied. The
recorded videos were used thereafter in a separate setting to calculate pCRT
via MATLAB. The averaged color of the ROI was extracted from the digital video
file, and the color change was represented as RGB waveforms. Figure 3 shows
the curve of the average contribution of each channel RGB collect from a
sequence of 35 seconds at three regions: before, during compression, and after
the applied pressure.

Figure 3:  Contribution of each channel (R-Red,G-Green and B-Blue) during 35 s
of the CRT test before. a) The camera is locked for approximately 7 s, the
extra 2 s (indicated by the arrows) are for the movement of the cylindrical
rod, which stops pressing for approximately 5 seconds. b) Solid line:
Exponential fit between the start of the capillary refill critical time
$t_{c}$.

After the removal of the cylindrical weight standard from the skin surface,
produce a pronunciation change in the intensity of the channel color. It is
notable, in the green channel, the presence of an expressive peak followed by
a decay. The time required skin color to return after the pressure exerted
correlates with the time it takes for the intensity to return to its natural
state (time of decay of the exponential curve). So, was designed this decay
time pCRT (Polarized Capillary Refill Time) because it comes from the image
formed by the light polarized from the skin’s surface.

A curve fitting the returning phase of the green channel was modeled as an
exponential decay until a critical time because the curve does not agree with
an exponential model for long times and is often noisy after about 8 seconds
of decay. To find the end of the region where the exponential is valid, a
sixth-order polynomial function order and a simple exponential decay are
simultaneously fit to the experimental curve, the point where these two
functions maximum divergence, we call critical time $(t_{c})$, indicate for
arrow in Figure 3b. So, we used a second exponential decay model until a
critical time to determine the pCRT characteristic time, by the equation:

$I=I_{O}exp(-t/pCRT).$ (1)

Data are presented as mean $\pm$ SD, minimum, and maximum. The reproducibility
test was evaluated by video assessment pCRT, each video was acquired five
times. In order to evaluate fit curve, was considered uncertainty
$\sigma_{i}=0.05$ (CI 95%) where i is each of five repetitions. Data analysis
was performed using OriginPro, version 9, and MATLAB.

##  3 Results

###  3.1 Change in skin colour with various photypes skin

The moment the skin surface compresses, the blood is temporarily blocked out
of the ROI, causing the skin to appear whitened (in some cases yellowish)
instead of pink or brown (normal color). In healthy tissue, color returns
quickly as blood re-establishes itself in dermal capillaries [4] this color
return is the basis of the CRT test. The green channel exhibit the lowest
signal-to-noise ratio and high contrast compared with other channels (Fig. 3).
And possibility the study the decay time of behavior in various groups
phototypes. Table 2 summarizes the value pCRT by method image analysis in each
phototypes group (Figure 4). All group is possible measurement the capillary
refill time.

Table 2: Comparison value mean pCRT between different Phototype by the Fitzpatrick classification. pCRT indicates capillary refill time by polarized measured by our investigation. SD indicates average standard derivation of five repetitions measurement of pCRT. | Mean pCRT (s) |  $\pm$ SD | Number of volunteers
---|---|---|---
Phototypes I - II | 4.0 | 0.7 | 9
Phototypes III - IV | 4.4 | 1.3 | 8
Phototypes V- VI | 3.7 | 1.7 | 5

In dark-skinned people (skin phototype V and VI) the change in skin color
after applied compression has low contrast, unlike what happens for light-
skinned people, skin phototype I, (Figure 4.a), making visual testing
impossible, as already reported by some authors [4, 26]. However, when we
perform of the pCRT analysis (Table 2). Thus, pCRT is a method that makes it
possible to quantify the CRT for different skin phototypes.

Figure 4:  Image of the forearm of three volunteers with different skin
phototypes group. a) Phototype I-II, b) Phototype III-IV and c) Phototype
V-VI. Above: demarcated region shows the color of the arm before the pressure
applied and below. After: releasing the compressor instrument.

###  3.2 Reproducibility test pCRT

We tested the behavior of the proposed method by five repeats with one minute
between each video. For this, we tested the uncertainty calculated by the rate
$\sigma_{i}/pCRT_{i}$ where $\sigma$ considered the 95% confidence interval
(CI) by adjusting the exponential green channel for each pCRT value and $i$ is
the number of measurements for every five repetitions, this percentage rate
(Figure 5).

Figure 5:  a) Distribution of $N=110$ pCRT values (5 points from 22
volunteers). The trend of the points follows a Gaussian distribution (Line in
red) $\mu=3.9;\sigma=1.3;FWHM=3.3$. b) Distribution of the uncertainty
evaluation by Equation: $\sigma_{i}/pCRT_{i}$. In both Histogram graph one
point was excluded because show outside value in mean.

The obtained results for the proposed method in a histogram form are presented
in Fig. 5.(a). The mean of the pCRT was 4.4 $\pm$ 1.4 s with range (3.8 - 4.3)
s. Figure 5.(b) shows the values of the uncertainty evaluation, the average
variation coefficient was 18% (5.7 - 61.2%). Only one measurement showed
greater than 20% in the pCRT value in this case, we delete the value, for
analysis. Additionally, pCRT value by the uncertainty evaluation in three
groups phototypes, calculated from results presented in Fig. 5, are shown in
Fig 6.

Figure 6:  Distribution of 110 pCRT values by five repetitions by each of
twenty-two volunteers before the data rejection analysis. Arrow show point the
volunteer’s high divergence. Inset show zoom of region littler variation of
the coefficient of variation equal 20% Error bars show the CI 95% for the pCRT
from fit curve the green channel.

The results show that in the five successive measurements $CV$ was low (20%
representing 0.5 s), only one volunteer showed a variation higher than 28%.
Using a single measure, with one video image, the of value pCRT was used by
the 95% CI of the exponential decay adjustment. In this investigation, we have
arbitrarily defined a criterion where if the uncertainty (95% CI) of the
exponential decay is greater than 10% of the pCRT value; we advise you to
retake the test. Figure 7 shows the application of this criterion. Thus, it
excluded about 20 % of the measurements.

In Figure 7, show the value for individual pCRT normalized by the mean pCRT,
of the five repetitions for each volunteer. The rejection of the points with
the coefficient of variation (CV) higher than 10% in the exponential fit has
produced value the confidence in one measurement of 80% of the remaining
measurements are within ($\pm$ 0.20) units of the average pCRT. Consider the
range $\delta=$ $\pm$ 20 % by pCRT normalized by the mean. If the test
performed only once, there is an 80 % chance that the result is within $\pm$
20% of the expected pCRT value. However, the 10 % uncertainty in the fit
criterion is more efficient to eliminate the overestimates of pCRT than
underestimates.

Figure 7:  Distribution of pCRT values weighted by the average of each
volunteer before $(\sigma_{i}/pCRT_{i})$ \- 110 measurements and after the
data rejection analysis $(\sigma_{i}/pCRT_{i}<10\%)$ \- 86 measurements. The
inset shows that e.g. 80% of the pCRT readings are within 20% of pCRT mean by
five repetitions $(<pCRT>)$ for a given volunteer. The gray box indicates a
range of $\pm 20\%$ of relative precision. The median and minimum and maximum
interquartile ranges are shown.

##  4 Discussion

This study considered the report of some authors [4, 26], furthermore the lack
of research that performs the traditional capillary filling time test in
patients with phototypes V and VI. As reported by [4, 26, 27], in patients
with dark skin (phototypes V and VI) is difficulty in making a visual
assessment of the skin because of the high concentration of melanin in dark
skin makes the diagnosis of peripheral perfusion. The inability to visualize
the color change in dark-skinned people make it difficult to diagnoses not
only the CRT test but also in another diagnosis, as e.g. the assessment of the
pressure ulcer stage [4] and there is interest in areas such as assessment of
tissue breakdown leading to foot ulceration for patients with diabetes [28].
Thus, in several countries with high heterogeneous group colors skins, such as
Brazil, its possibilities this measured the test CRT with significant
variations in skin color.

This study has developed a method to analyze the image to forearm using
polarized light during the test CRT. The results showed the possibility of
measuring pCRT in volunteers with different skin phototypes and with low
compression (7 kPa). Analyzing the color change of the forearm surface using
polarized light with the CRT test provides the use of the technique in
different body sites. Techniques optical use transmitted light can restrict
the measurement location because it applies in regions with low deep, e.g.
fingertip [29, 19]. In this work, we showed the use of circular polarizers for
image acquisition, providing the study and quantification of pCRT in subjects
with skin phototypes V and VI and with low compression pressure. In these
subjects, there is a high concentration of melanin in the epidermis, which
causes an error in obtaining the CRT measurement, since the melanin absorbs
much of the light, so the reflected light contribution comes from the melanin
contribution and not from the perfusion change caused in the dermis during
compression, this generates an error in the quantification of CRT in dark
skin. Polarizers eliminate a specular reflection component that allows us to
study deeper regions of the skin surface [30, 31]. For people with skin
phototype V and VI, there is a high concentration of melanin on the skin
surface or difficulty in analyzing changes in skin color using CRT by the
visual method. As seen, our results showed the possibility of quantitative
measurement pCRT in interviews with different phototypes.

pCRT value gets in this work presents the same order of magnitude established
in the literature for CRT. But, given the high sensitivity of RGB cameras
compared to the human eye, pCRT has an acute sensitivity compared to
traditional CRT. But these data offer a reliable reference sheds new light on
the accuracy of investigation devices for measuring peripheral perfusion
status. All subjects studied the behavior curve of the green channel showed a
better signal-to-noise ratio (SNR) compared to the other channels. With this
an exponential function adjusted in this way, the decay time of the
exponential considered the return time of the skin color (pCRT) for that, it
was necessary to adjust functions and thus we created a cutoff criterion
($t_{c})$ of the region of the short had more stability (Figure 3). We are not
aware of earlier studies that performed the CRT test on patients in this group
(Table 2). Although the study had few volunteers, the results were
reproducible (Figure 7).

Several factors can influence the CRT test and its results. The quantity of
compression in skin surface is important for the blanching. In the traditional
CRT assessments, visual and manual, the compression is subjective. Kawaguchi
et al. investigate the quantity pressing in the fingertips with 10 kPa–70 kPa
for 2 s appears to be optimal [32]. Some studies proposed the pressure using
was 17 kPa [12, 33], others studies used compression in order 60 kPa [19]. In
this study, the results showed the possibility of measurement of the CRT test
using compression with 7 kPa on the skin surface at the forearm. This results
in using the circularly polarized light. This technique improves image
resolution and extracting light that has propagated only within superficial
tissue [24, 30, 31]. The value of pCRT showed high precision and
reproducibility.

Green channel presented (Figure 3) a better signal-to-noise ratio (SNR) and
greater contrast about the other channels. Two factors may be related to this
result. Disproportion is caused by the concentration of oxyhemoglobin
($HbO_{2}$) in the epidermal tissue during compression. At this time, there is
a decrease in $HbO_{2}$ in the tissue and after the release of the compression
instrument, there is an increase in the equilibrium point. Absorption spectra
of oxyhemoglobin show two high absorption peaks 540 nm and 577 nm. A possible
explanation for the high variation about the baseline in the green channel is
the fact that the sensitivity curve of the camera used in the experiment
presents the green channel within the high sensitivity range of the $HbO_{2}$
peak. Also, the use of a circular polarizer with a quarter-wave plate from 125
nm, ensures circular polarization in the 500 nm range, thus generating the
response in the green channel.

The influence of variation skin temperature during the acquisition of the
videos and the concern of the pressure instrument to generate the presence of
pain may have caused a stressful situation in the volunteers. The stress
situation contributes to the activation of the cascade activates the
sympathetic nervous system during the test CRT [22, 34]. Also, we believe the
significant increase or decrease in HR data collection may be responsible for
the high variability in inter-participant [35] in the five repetitions the
test pCRT found in this study. Thus, we point one of the limitations of this
experiment, the fact that we do not measure the temperature gradient of the
skin surface during data collection. Because of the small number of volunteers
in this study, we did not investigate CRT varied with HR. However, the
relationship between these factors should be analyzed in future studies.

This study opens up the possibility of further work that uses the CRT test in
patients for the evaluation of peripheral perfusion and other diagnoses. Also,
the development of new ways of extracting the image from the RGB channels for
discoveries. Circular polarizer analyzer filtering in the acquisition of
images shows the possibility of study in patients with different skin
phototypes and age. Our results indicate evidence consistent with those found
by other studies [19]. However, we show a new methodology for image
acquisition and consequently quantification of capillary refill time.
Contributions show it might be possible to devise and implement a system for
determining a robust metric to assess skin perfusion that is gentle, observer-
independent, and allows for the assessment of CRT in patients with different
skin colors.

##  5 Conclusion

More and more the development of metrics for the assessment of peripheral
perfusion is necessary, however, the shortcoming of traditional methods of
analysis restrict its development. Recently, the use of images has shown
advantages in the processing of medical data and has achieved good
effectiveness in many fields. Although more studies are needed to validate
these metrics.

The CRT is used to evaluate peripheral perfusion. However, the traditional
measurement has high uncertainty is the dependency on the observer’s
performance [6]. Therefore, in this paper, we developed a methodology using
light polarized for image acquisition and processing to be used in the
measurement of peripheral perfusion.

The green channel decay showed a good contrast that allows the determination
of a characteristic time (pCRT) that is a surrogate for CRT. This methodology
was able to quantify the CRT in volunteers with various groups prototypes
skin, with a high concentration of melanin, in anemic conditions with low
compressure (7 kPa). Experimental results show that the pCRT model has
achieved high accuracy (approximate 80%), and has the potential and value to
promote the clinical application.

##  6 Acknowledgements

The authors special thanks to Beatriz Janke, C. Renato da Silva and all the
volunteers who participated in the experiment. This study was financed in part
by the Coordenação de Aperfeiçoamento de Pessoal de Nível Superior - Brasil
(CAPES) - Finance Code 001.

## References

  * [1] Kothandapany S.  Importance of skin color in therapeutic and diagnostic applications.  International Journal of Advanced Medical and Health Research. 2014;1(1):3.
  * [2] Lima A, Jansen TC, Van Bommel J, Ince C, Bakker J.  The prognostic value of the subjective assessment of peripheral perfusion in critically ill patients.  Critical Care Medicine. 2009 mar;37(3):934–938.
  * [3] Champion HR, Sacco WJ, Hannan DS, Lepper RL, Atzinger ES, Copes WS, et al.  Assessment of injury severity: the triage index.  Critical care medicine. 1980;8(4):201–208.
  * [4] Matas A, Sowa MG, Taylor V, Taylor G, Schattka BJ, Mantsch HH.  Eliminating the issue of skin color in assessment of the blanch response.  Advances in skin & wound care. 2001;14(4):180–188.
  * [5] Lanting SM, Barwick AL, Twigg SM, Johnson NA, Baker MK, Chiu SK, et al.  Post-occlusive reactive hyperaemia of skin microvasculature and foot complications in type 2 diabetes.  Journal of Diabetes and its Complications. 2017 aug;31(8):1305–1310.
  * [6] Valenzuela Espinoza ED, Welsh S, Dubin A.  Lack of agreement between different observers and methods in the measurement of capillary refill time in healthy volunteers: An observational study.  Revista Brasileira de Terapia Intensiva. 2014.
  * [7] King D, Morton R, Bevan C.  How to use capillary refill time.  Archives of Disease in Childhood: Education and Practice Edition. 2014\.
  * [8] Nickel A, Jiang S, Napolitano N, Saeki K, Circulation HH.  Impact of Skin Color on Accuracy of Capillary Refill Time Measurement by Pulse Oximeter.  Am Heart Assoc. 2018.
  * [9] Pickard A, Karlen W, Ansermino JM.  Capillary refill time: Is it still a useful clinical sign?  Anesthesia and Analgesia. 2011;113(1):120–123.
  * [10] Mrgan M, Rytter D, Brabrand M.  Capillary refill time is a predictor of short-term mortality for adult patients admitted to a medical department: An observational cohort study.  Emergency Medicine Journal. 2014 dec;31(12):954–958.
  * [11] Crook J, Taylor RM.  The agreement of fingertip and sternum capillary refill time in children.  Archives of Disease in Childhood. 2013;98(4):265–268.
  * [12] Blaxter LL, Morris DE, Crowe JA, Henry C, Hill S, Sharkey D, et al.  An automated quasi-continuous capillary refill timing device.  Physiological Measurement. 2015 dec;37(1):83–99.
  * [13] Ait-Oufella H, Bige N, Boelle PY, Pichereau C, Alves M, Bertinchamp R, et al.  Capillary refill time exploration during septic shock.  Intensive Care Medicine. 2014;40(7):958–964.
  * [14] Pandey A, John BM. Capillary refill time. is it time to fill the gaps?. Medical Journal Armed Forces India; 2013.
  * [15] Otieno H, Were E, Ahmed I, Charo E, Brent A, Maitland K.  Are bedside features of shock reproducible between different observers?  Archives of Disease in Childhood. 2004 oct;89(10):977–979.
  * [16] Fleming S, Gill P, Jones C, Taylor JA, Van Den Bruel A, Heneghan C, et al.  The diagnostic value of capillary refill time for detecting serious illness in children: A systematic review and meta-analysis.  PLoS ONE. 2015 sep;10(9).
  * [17] World Health Organization (WHO) and the Special Programme for Research and Tropical Diseases (TDR).  CLINICAL MANAGEMENT AND DELIVERY OF CLINICAL SERVICES.  In: Dengue: Guidelines for Diagnosis, Treatment, Prevention and Control: New Edition. World Health Organization; 2009. p. 23–55.
  * [18] Gorelick M, Shaw K, Pediatrics MB, 1993 U.  Effect of ambient temperature on capillary refill in healthy children.  Am Acad Pediatrics. 1993.
  * [19] Shinozaki K, Jacobson LS, Saeki K, Kobayashi N, Weisner S, Falotico JM, et al.  Does training level affect the accuracy of visual assessment of capillary refill time?  Critical care (London, England). 2019;23(1):157.
  * [20] Anderson B, Kelly AM, Kerr D, Jolley D.  Capillary refill time in adults has poor inter-observer agreement.  Hong Kong Journal of Emergency Medicine. 2008 apr;15(2):71–74.
  * [21] Osborn DA, Evans N, Kluckow M.  Clinical detection of low upper body blood flow in very premature infants using blood pressure, capillary refill time, and central-peripheral temperature difference.  Archives of Disease in Childhood: Fetal and Neonatal Edition. 2004;89(2).
  * [22] Schriger DL, Baraff L.  Defining normal capillary refill: Variation with age, sex, and temperature.  Annals of Emergency Medicine. 1988;17(9):932–935.
  * [23] Chang TP, Santillanes G, Claudius I, Pham PK, Koved J, Cheyne J, et al.  Use of a Novel, Portable, LED-Based Capillary Refill Time Simulator within a Disaster Triage Context.  Prehospital and Disaster Medicine. 2017.
  * [24] Groner W, Winkelman JW, Harris AG, Ince C, Bouma GJ, Messmer K, et al.  Orthogonal polarization spectral imaging: A new method for study of the microcirculation.  Nature Medicine. 1999 oct;5(10):1209–1212.
  * [25] Lima A, Bakker J.  Noninvasive monitoring of peripheral perfusion.  In: Applied Physiology in Intensive Care Medicine 2: Physiological Reviews and Editorials; 2012. p. 39–49.
  * [26] Saavedra JM, Harris GD, Li S, Finberg L.  Capillary Refilling (Skin Turgor) in the Assessment of Dehydration.  American Journal of Diseases of Children. 1991;145(3):296–298.
  * [27] Bickler PE, Feiner JR, Severinghaus JW.  Effects of skin pigmentation on pulse oximeter accuracy at low saturation.  Anesthesiology. 2005;102(4):715–719.
  * [28] Klupp NL, Keenan AM.  An evaluation of the reliability and validity of capillary refill time test.  Foot. 2007 mar;17(1):15–20.
  * [29] Oi Y, Sato K, Nogaki A, Shinohara M, Matsumoto J, Abe T, et al.  Association between venous blood lactate levels and differences in quantitative capillary refill time.  Acute Medicine & Surgery. 2018 oct;5(4):321–328.
  * [30] Stockford I, Morgan S.  Surface-reflection elimination in polarization imaging of superficial tissue.  Opt Lett. 2003 jan;28(2):114–116.
  * [31] Borovkova M, Bykov A, Popov A, Meglinski I.  Influence of scattering and birefringence on the phase shift between electric field components of polarized light propagated through biological tissues.  In: Amelink A, Nadkarni SK, editors. Optics InfoBase Conference Papers. vol. Part F142-. SPIE; 2019. p. 25.
  * [32] Kawaguchi R, Nakada TA, Oshima T, Shinozaki M, Nakaguchi T, Haneishi H, et al.. Optimal pressing strength and time for capillary refilling time. BioMed Central Ltd.; 2019.
  * [33] Liu C, Correia R, Ballaji H, Korposh S, Hayes‐gill B, Morgan S.  Optical fibre sensor for simultaneous measurement of capillary refill time and contact pressure.  Sensors (Switzerland). 2020;20(5).
  * [34] Cho Y, Julier SJ, Bianchi-Berthouze N.  Instant stress: Detection of perceived mental stress through smartphone photoplethysmography and thermal imaging.  Journal of Medical Internet Research. 2019 apr;21(4).
  * [35] Jacquet-Lagrèze M, Bouhamri N, Portran P, Schweizer R, Baudin F, Lilot M, et al.  Capillary refill time variation induced by passive leg raising predicts capillary refill time response to volume expansion.  Critical Care. 2019 dec;23(1):281.


# A Sealed-bid Auction with Fund Binding: Preventing Maximum Bidding Price
Leakage

Kota Chin
University of Tsukuba
National Institute of
Information and
Communications Technology
Japan Keita Emura  National Institute of
Information and
Communications Technology
Japan Kazumasa Omote
University of Tsukuba
National Institute of
Information and
Communications Technology
Japan Shingo Sato
Yokohama National University
Japan

###### Abstract

In an open-bid auction, a bidder can know the budgets of other bidders. Thus,
a sealed-bid auction that hides bidding prices is desirable. However, in
previous sealed-bid auction protocols, it has been difficult to provide a
“fund binding” property, which would guarantee that a bidder has funds more
than or equal to the bidding price and that the funds are forcibly withdrawn
when the bidder wins. Thus, such protocols are vulnerable to false bidding. As
a solution, many protocols employ a simple deposit method in which each bidder
sends a deposit to a smart contract, which is greater than or equal to the
bidding price, before the bidding phase. However, this deposit reveals the
maximum bidding price, and it is preferable to hide this information. In this
paper, we propose a sealed-bid auction protocol that provides a fund binding
property. Our protocol not only hides the bidding price and a maximum bidding
price, but also provides fund binding, simultaneously. For hiding the maximum
bidding price, we pay attention to the fact that usual Ethereum transactions
and transactions for sending funds to a one-time address have the same
transaction structure, and it seems that they are indistinguishable. We
discuss how much bidding transactions are hidden. We also employ DECO (Zhang
et al,. CCS 2020) that proves the validity of the data to a verifier in which
the data are taken from a source without showing the data itself. Finally, we
give our implementation which shows transaction fees required and compare it
to a sealed-bid auction protocol employing the simple deposit method.

###### Index Terms:

Blockchain, Sealed-bid Auction, Price Hiding, Fund Binding

##  I Introduction

###  I-A Background

Non-Fungible Tokens (NFTs) have received much attention recently, as digital
assets such as artworks have been traded on blockchains, and open-bid auctions
via smart contracts have been frequently held. For example, the NFT of Kabosu
(the name of the female Shiba Inu dog that became the Internet meme “Doge”)
was one of the most expensive NFT of all, with a bidding price of 1696.9 ETH
(approximately 400 million USD using the Ether price on June 11,
2021).111Transaction detail is available at
https://etherscan.io/tx/0x8668bb338f7cf9896db75c00e8bef18cc549d04b2dcaf1cee01dc0e1522e7e87
Thus, open-bid auctions based on smart contracts have been used for
transactions of relatively expensive assets and have acquired a certain degree
of reliability. However, they also treated relatively cheap assets; for
example, the mean price of NFTs traded during July 2021 was approximately 711
USD.222We calculate it from data obtained by NFT market place OpenSea
(https://dune.xyz/rchen8/opensea)

If the bidding prices of other bidders are open, then other potential bidders
can determine their bidding prices according to these bids. In addition, if
smart contracts are employed, anyone can view the balance of addresses used
during the bidding process and guess the budgets of other bidders. Thus, the
final selling price may be lower because bidders do not bid a price higher
than the budgets of other bidders. This is to the detriment of the seller and
auctioneer. Therefore, it is desirable to employ sealed-bid auction in which
no bidder can know the bidding prices of other bidders in advance.

###  I-B Previous Work

Many sealed-bid auction protocols employing smart contracts have been
proposed. However, this type of protocol necessitates ensuring a bidder has
funds more than or equal to the bidding price (called “fund binding”), but
because the bidding prices are hidden, this is difficult to do. Such protocols
are vulnerable to false bidding, meaning bidders indicate bidding prices, but
do not have the money to be paid. As a countermeasure, Galal and Youssef [13]
and Li et al. [19] considered using a small deposit, wherein if bidding prices
are false, then the deposit is automatically confiscated. However, their
proposals do not affect bidders who accept such a penalty. Another
countermeasure involves, each bidder being required to send a deposit more
than or equal to the bidding price. We call this method the “simple deposit
method” and has been widely employed, e.g., [32, 8, 17, 18, 16, 27, 31, 29, 1,
28, 15, 9]. However, even if the fund binding property is provided, the
maximum bidding price can be revealed. Accordingly, in open-bid auctions, the
final selling price may be lower because bidders do not bid a price higher
than the maximum bidding price. Thus, it is preferable to hide the maximum
bidding price, so items being auctioned sell closer to their actual value. In
the Ma et al. sealed-bid auction protocol [22], a commitment on a deposit is
computed before the bidding phase. Thus, at first sight, their protocol
provides fund binding without revealing the bidding price. However, it is not
guaranteed that a bidder who computes a commitment on a bidding price has
funds more than or equal to the bidding price. Thus, it is difficult to
provide a fund binding property in sealed-bid auction protocols.

###  I-C Our Contribution

In this paper, we propose a sealed-bid auction protocol providing the fund
binding property. Our protocol simultaneously provides the following:

  * •

Price Hiding: It guarantees that nobody can know bidding prices of other
bidders until the revealing phase. Especially, the maximum bidding price is
also hidden.

  * •

Fund Binding: It guarantees that a bidder has funds more than or equal to the
bidding price, and the funds are forcibly withdrawn when the bidder wins.

We emphasize that sealed-bid auction protocols with the simple deposit method
reveal the maximum bidding price although they provide fund binding. Our goal
in this work is to provide price hiding and fund binding simultaneously.

Our Technique. To achieve our goal, we pay attention to the fact that an
address of the smart contract can be calculated before deploying the contract,
and bidders issue a one-time address by themselves. Then, each bidder sends a
transaction to own one-time address. Here, we assume that a usual Ethereum
transaction and a bidding transaction to a one-time address are
indistinguishable, which is a reasonable assumption and allows us to hide the
maximum bidding price. For example, let the bidding phase be from August 9 to
15 (one week). Then there are 158,644 possible one-time addresses. We discuss
how much bidding transactions are hidden in Section V-A. We remark that, by
observing transactions during the bidding phase, the maximum bidding price can
be guessed because it is less than or equal to the trading price during this
phase. Therefore, we also assume that the actual maximum bidding price is not
revealed from transactions during the bidding phase. We discuss whether this
assumption is reasonable by observing actual transactions in Section V-B.

In addition to employing one-time addresses, each bidder is required to prove
that enough balance is preserved on the one-time address without revealing the
balance and the address. We employ DECO (DECentralized Oracle) [33] that
allows a bidder to prove the statement above in a zero-knowledge manner. In
particular, it allows bidders to prove that the balance is preserved on a one-
time address.

We implement our protocol and compare it to the simple deposit method. We show
that the two protocols require almost similar fee to run the protocol (the
additional fee was 10.25 USD on August 15, 2021).

Out of Scope for Our Work. Our protocol hides bidding prices during the
bidding phase. Each bidder sends a trapdoor (a decommitment of the underlying
commitment scheme), and then the auction smart contract reveals all bidding
prices and decides the winner. Although some sealed-bid auction protocols
consider how to decide the winner without revealing other bidding prices, we
do not consider to hide it after revealing since our goal in this work is to
provide price hiding and fund binding simultaneously during the bidding phase.
However, we expect that our protocol can be adopted/combined with other
sealed-bid auction protocol, and price hiding during the revealing phase seems
could be realized.

In our protocol, bidders open their bid commitments in an undefined order. So,
one may think that bidders do not want to open the commitments if another
bidder has already opened a higher bid. Actually, the information about how
much they bid in this auction might be useful to other bidders in subsequent
related auctions. For example, Naor et al. [24] hide all unsuccessful bids for
this reason. In our protocol, even such bidders have an incentive to send
decommitments since they have no way to withdraw the funds of the one-time
addresses. Thus, we assume that all bidders send their decommitments honestly,
and do not consider a case when bidders do not send their decommitments.

###  I-D Concurrent and Independent Work

In addition to sealed-bid auction protocols providing small or simple deposit
methods [13, 19, 32, 8, 17, 18, 16, 27, 31, 29, 1, 28, 15, 9], recently, David
et al. [10] proposed FAST (Fair Auctions via Secret Transactions) with the
same motivation as ours. That is, the deposit reveals information about the
bid, and thus it should be hidden. They introduced secret deposits based on
confidential transaction [23]. They defined deposit committee members (which
are different from bidders) and a trapdoor, which can be used to reveal the
value of deposits, that is distributed among $m$ deposit committee members
using a proactive secret sharing scheme [7]. There are $\ell$ rounds in total
where $\ell$ is the bit length of the bids. For each round, the anonymous veto
protocol [14] is run, and if a party is found to be cheating, a smart contract
automatically redistributes cheaters’ deposits among the honest parties, which
creates the incentive for parties to behave honestly. The main difference from
our protocol is complexity because FAST requires each bidder to communicate
with other bidders. That is O($\ell n$) computations are required where $n$ is
the number of bidders. Conversely, our protocol does not require any
interaction between bidders (a bidder is required to communicate with the
oracle for running DECO, and later the bidder communicates with the auction
smart contract only). Moreover, FAST needs to assume that the number of
corrupted deposit committee members is less than $m/2-2$, whereas we do not
require such a limitation. From our perspective, FAST employs a cryptographic
approach to hide and bind the deposit whereas we employ another approach where
a transaction of the usual transfer of Ethereum and a transaction for sending
a bidding price to a one-time address are indistinguishable. This drastically
reduces the complexity of the protocol for hiding and binding deposits.

##  II Preliminaries

###  II-A Ethereum and Smart Contracts

Ethereum [6] is a platform for decentralized applications based on blockchain
technology. It allows users to create applications that run on the Ethereum
Virtual Machine (EVM), called smart contracts. The results of smart contract
execution are shared and agreed upon among all Ethereum nodes, making it
difficult to tamper.

ETH is a native token on Ethereum and is used to pay transaction fees. The
transaction fee is calculated by multiplying the amount of used gas by gas
price. The amount of gas used by the transaction varies depending on the
operations. Gas price also fluctuates according to the demand of the Ethereum
network. A web service called Etherscan333https://etherscan.io/ allows users
to check the balance of their addresses and transaction information.

###  II-B Oracles

Smart contracts cannot directly retrieve data outside the blockchain, such as
ETH price, stock prices, weather, or election results. Therefore, if a smart
contract requires the use of these data, then someone needs to input them into
the smart contract from outside. An entity that inputs data from outside the
blockchain to a smart contract is called an oracle.

Currently, Chainlink [21] is the protocol with the largest share among the
oracles. Chainlink is a decentralized oracle network that aggregates data
obtained by multiple oracle nodes to prevent oracle fraud. In addition,
because Chainlink nodes are financially penalized if they deviate from the
Chainlink protocol, they are trustworthy in terms of their behavior according
to the protocol.

###  II-C DECO

In this section, we introduce DECO [33] which allows a user to prove the
possession of data in a zero-knowledge manner wherein the data come from a
particular website via TLS (Transport Layer Security). We indicate Etherscan
as the website in our protocol. An oracle sends data to a smart contract, such
as the Ethereum price. A general issue with this structure is how to validate
whether the data actually come from a particular source. DECO contains three
entities: a data source (e.g., a particular website) ${\mathcal{S}}$, a prover
${\mathcal{P}}$, and a verifier ${\mathcal{V}}$. To access ${\mathcal{S}}$,
some secret value is required such as salt. Then, ${\mathcal{P}}$ proves that
the data come from ${\mathcal{S}}$ without showing the data, and
${\mathcal{V}}$ checks the validity of the proof. The flow of DECO is
explained as follows. Assume that communication between ${\mathcal{P}}$ and
${\mathcal{S}}$ is protected by TLS. Then, via a three-party handshake, a key
for MAC (Message Authentication Code), denoted by $k_{\sf MAC}$, is shared by
${\mathcal{P}}$ and ${\mathcal{V}}$ in a secret sharing manner
(${\mathcal{P}}$ obtains $k_{P}$ and ${\mathcal{V}}$ obtains $k_{V}$ where
$k_{\sf MAC}=k_{P}+k_{V}$), and ${\mathcal{S}}$ knows $k_{\sf MAC}$ as usual.
A key for encryption is known by ${\mathcal{P}}$ and ${\mathcal{S}}$ as usual.
In this setting, with the help of ${\mathcal{V}}$, ${\mathcal{P}}$ can make a
query sent to ${\mathcal{S}}$ via TLS. More concretely, ${\mathcal{P}}$ and
${\mathcal{V}}$ run a MPC (Multi-Party Computation) that takes $k_{P}$ and
$k_{V}$ as input, respectively. We remark that ${\mathcal{V}}$ cannot observe
the content of the encrypted query because ${\mathcal{V}}$ does not have the
encryption key. ${\mathcal{P}}$ generates a commitment on the query and the
response from ${\mathcal{S}}$, and sends the commitment to ${\mathcal{V}}$.
Then, ${\mathcal{V}}$ sends $k_{V}$ to ${\mathcal{P}}$, and ${\mathcal{P}}$
recovers $k_{\sf MAC}$, and checks the MAC on the response from
${\mathcal{S}}$. Finally, ${\mathcal{P}}$ generates a zero-knowledge proof for
the query and sends it to ${\mathcal{V}}$.

The DECO website444https://www.deco.works/ states that _Chainlink[21] plans to
perform an initial PoC of DECO, with a focus on decentralized finance
applications such as Mixicles_. Then, a user would be able to prove the
validity of the data containing their own personal information to a Chainlink
node. In the proposed scheme, we employ DECO to prove that a bidder has funds
that are equal to the bidding price to an oracle. Then the bidder is regarded
as ${\mathcal{P}}$, the oracle is regarded as ${\mathcal{V}}$, and Etherscan
is regarded as ${\mathcal{S}}$.

###  II-D Hash-based Commitment Scheme

In this section we introduce a hash-based commitment scheme. A commitment
scheme $({\sf Commit},{\sf ComOpen})$ is defined as follows. The ${\sf
Commit}$ algorithm takes as input a message $M$, and outputs a commitment
${\sf com}$ and a decommitment ${\sf dec}$. The ${\sf ComOpen}$ algorithm
takes as input ${\sf com}$, ${\sf dec}$, and $M$, and outputs 0 (reject) or 1
(accept). A commitment scheme is required to provide hiding where no adversary
can obtain information of $M$ from ${\sf com}$, and is required to provide
binding where no adversary can produce ${\sf dec}$ and ${\sf dec}^{\prime}$
where ${\sf ComOpen}({\sf com},{\sf dec},M)=1$, ${\sf ComOpen}({\sf com},{\sf
dec}^{\prime},M^{\prime})=1$, and $M\neq M^{\prime}$ holds.

Next, we select the commitment scheme to be employed in our implementation.
Because the smart contract runs the ${\sf ComOpen}$ algorithm, it is desirable
to select an efficient scheme to reduce the gas price. Therefore, we select a
hash-based commitment scheme. Let ${\sf
Hash}:\\{0,1\\}^{\ast}\rightarrow\\{0,1\\}^{k}$ where $k$ is a security
parameter. In the ${\sf Commit}$ algorithm, choose a random
$R\xleftarrow{\$}\\{0,1\\}^{k}$, compute ${\sf com}={\sf Hash}(M||R)$, and
output ${\sf com}$ and ${\sf dec}=R$. The ${\sf ComOpen}$ algorithm outputs 1
if ${\sf com}={\sf Hash}(M||{\sf dec})$ holds, and 0, otherwise. This hash-
based scheme provides both hiding and binding if ${\sf Hash}$ is modeled as a
random oracle [26, 30].

The commitment scheme provides either statistical hiding or statistical
binding according to the range size [26, 30]. Specifically, for ${\sf
Hash}:\\{0,1\\}^{2n}\rightarrow\\{0,1\\}^{\ell(n)}$, the scheme provides
statistical hiding if $\ell(n)=n/8$, and statistical binding if $\ell(n)=4n$,
respectively. In our implementation, we employ SHA256 as the underlying hash
function because SHA256 has been prepared in a smart contract environment as a
pre-compiled function, and can be efficiently run with a low gas usage. For
our usage, the input length is 768 bits (one-time address [256 bits]+a bidding
price [256 bits]+a random $R$ [256 bits]). Thus, the hash function is defined
as ${\sf Hash}:\\{0,1\\}^{768}\rightarrow\\{0,1\\}^{256}$. Because our usage
does not match the above cases, the commitment scheme provides computational
hiding and computational binding.

###  II-E Zero-Knowledge Proofs

Zero-knowledge proofs/arguments for a committed value are required in DECO. In
this section, we show the feasibility of the zero-knowledge argument for the
hash-based commitment scheme, that is, a proof of $M$ and $R$ satisfying ${\sf
com}={\sf Hash}(M||R)$, especially when SHA256 is chosen as the underlying
hash function. First, generate an arithmetic circuit $C$ to compute SHA256
that can be obtained by the circuit generator [25] with a C program to compute
SHA256. Next, we can produce a disable argument system by employing zk-SNARK
(zero-knowledge Succinct Non-interactive ARgument of Knowledge) for arithmetic
circuits [5]. Ben-Sasson et al. [4] provided a hand-optimized arithmetic
circuit for the SHA256 compression function and then reduced the number of
gates compared to that generated by the circuit generator [25]. Although we
may also be able to reduce the number of gates by providing a hand-optimized
arithmetic circuit for SHA256, here we only show the feasibility because zero-
knowledge proofs/arguments are run in an off-chain and we focus on how to
reduce the gas price for running smart contracts.

##  III Proposed Sealed-bid Auction with Fund Binding

In this section, we introduce the proposed protocol. Figure 1 shows a sequence
diagram of the proposed protocol. We employ a smart contract as an auctioneer
that collects bid amounts in a hidden manner and decides the winner of the
auction. We refer to the smart contract as the auction contract. The proposed
protocol does not require a deposit because it reveals the maximum bidding
price; thus, bidders do not directly send their own bidding price to the
auction contract. The bidder sends funds to a fund-binding contract deployed
from the auction contract. Here, the bidder can compute the address of a fund-
binding contract before deployment via CREATE2 opcode. We call the address of
a fund-binding contract a one-time address. In the proposed protocol, one-time
addresses are used before deploying the fund-binding contract. We assume that
other users’ usual transactions and transactions to the one-time address are
indistinguishable. Then, a one-time address and its balance will be kept
secret. Next, the bidder enters a commitment of the bidding price into the
auction contract, and uses DECO [33] to prove that the balance of the one-time
address is the same as the bidding price. We emphasize that DECO is run in an
off-chain among Etherscan, a bidder, and an oracle node, and the auction
contract just checks the validity of signatures sent from the oracle. Finally,
the auction contract deploys fund-binding contracts whose addresses are
bidder’s one-time addresses. Then, the auction contract withdraws the funds
from one-time addresses, and determines the winning bidder by the opening
result of commitments. As mentioned before, we assume that all bidders send
their decommitments honestly because they have no way to withdraw the funds of
the one-time addresses.

Figure 1: The Sequence Diagram of The Proposed Protocol

###  III-A Starting an Auction

A seller who wants to start an auction sends auction information such as the
duration of the bidding phase and the revealing phase to the smart contract.
In this paper, we refer to this smart contract as an auction contract. At this
time, a unique number is assigned to each auction managed by the auction
contract as an “auction ID”.

###  III-B Bidding Phase

A bidder, who wants to bid on the auction, performs the following steps during
the bidding phase.

####  III-B1 Issuing One-time Address

A one-time address is a disposable address that is issued for a certain
purpose. For example, in our proposed protocol, a one-time address is used to
bind the funds. If there is a trusted third party, the third party can issue a
one-time address. However, assuming a trusted party is a much stronger
assumption, and it would be better to avoid introducing it in cryptographic
protocols as much as possible. To issue a one-time address without any trusted
third party, we observe that an address of a smart contract can be calculated
in advance, that is, before the smart contract is deployed.555This fact has
been utilized in protocols such as Argent [2] on Ethereum. Specifically, we
can precompute the address from the following arguments using CREATE2 opcode
when deploying fund-binding contacts.

  * •

A salt

  * •

A bytecode of the fund-binding contact

  * •

An address of the auction contract

In this paper, the salt is defined as a concatenation of the auction ID, the
bidder’s address, which is used to deposit to the one-time address, and a
random value chosen by the bidder. Thus, the bidder is the only one who can
know the one-time address until the salt is revealed. Note that only an
auction contract can deploy a fund-binding contract to a one-time address and
can withdraw funds from a one-time address.

####  III-B2 Bidding

A bidder sends funds to the one-time address issued. A bidder is required to
send the bidding amount to a one-time address from an address that the bidder
does not use to send bidding information to the auction contract. If the
bidder uses the same address, it helps to distinguish whether an address is
related to the auction, and our assumption does not hold.

####  III-B3 Proving of Bidding using DECO

Each bidder is required to prove that the bidding price is preserved at a one-
time address. If this proof of balance is not required, then a bidder can
submit multiple bids using different one-time addresses and select any bid
during the revealing phase according to the other bids. In the proposed
protocol, the bidder proves to the oracle node that the balance of the one-
time address displayed by Etherscan is equal to the bidding price using
DECO.666We modified an application of binary options using DECO [33]. Let
Etherscan be ${\mathcal{S}}$, the bidder be ${\mathcal{P}}$, the oracle be
${\mathcal{V}}$, and $({\sf vk}_{\mathcal{O}},{\sf sigk}_{\mathcal{O}})$ be
the oracle’s verification key and signing key. The secret information for the
bidder’s access to Etherscan is the one-time address $\theta_{p}$. First, the
bidder sets $P$ as the bidding price, calculates $({\sf com}_{P},{\sf
dec}_{P})={\sf Commit}(P)$, and sends ${\sf com}_{P}$ to the auction contract.
The auction contract issues a unique number as the bid ID that correspond to
the commitment. Next, the Etherscan, a bidder, and the oracle execute DECO,
and the bidder obtains from the Etherscan that the balance value of the one-
time address is $P^{\ast}$. Note that the oracle does not know which page in
the Etherscan corresponds to the bidder because the query is hidden. This
means that the oracle cannot learn the one-time address of the bidder. The
bidder then provides the oracle with a zero-knowledge proof of knowledge that
$P^{*}$ was obtained from $\theta_{p}$, plus ${\sf ZK}\text{-}{\sf
PoK}\\{P^{*}:{\sf com}_{P}={\sf Commit}(P^{*})\\}$. This shows that the
committed value P stored in the auction contract before the execution of DECO
is $P^{*}$. If the proof is valid, the oracle generates a signature on the bid
ID using ${\sf sigk}_{\mathcal{O}}$ as a credential. Finally, the bidder sends
the oracle’s signature to the auction contract, and if the signature is valid,
the auction contract accepts the bidding of ${\sf com}_{P}$ specified by the
bid ID.

###  III-C Revealing Phase

In the revealing phase, the bidder reveals the bidding price according to the
following procedure.

####  III-C1 Revealing Salt and Decommitment

The bidder sends the auction ID, the bidding price, the salt, and the
decommitment to the auction contract. Based on the salt, the auction contract
deploys a fund-binding contract, that is, a one-time contract for fund
collection, to the bidder’s one-time address. The auction contract withdraws
the funds from the one-time contract. The auction contract then runs the ${\sf
ComOpen}$ algorithm (described in Section II-D) against commitments whose bid
ID have been verified. The auction contract obtains a bidding price, and if it
is greater than the current highest bid, then the auction contract updates the
current highest bid. Otherwise, if it is less than the current highest bid,
then the auction contact refunds the funds. We remark that the auction
contract only holds the funds of the highest bidder. We assume that there is
one highest bid and do not consider the case that there are many highest bids
because it depends on a rule of the auction.

Since funds of the one-time contract have been verified using DECO at the
bidding phase, funds will never be less than the committed amount. Therefore,
all funds of bidders who do not reveal the salt are locked. As mentioned
above, only the auction contracts can withdraw the funds. One may wonder the
freshness of the data source. Actually, a bidder can send ETH even after
proving of the bidding price using DECO (although the bidder cannot withdraw
the balance). Even then, we assume that the auction contract selects the
committed bidding price. On the other hand, if the auction contract employs
the funds withdrawn from the one-time contract, then this rule gives the
bidder a room for increasing the funds after the bidding phase.

###  III-D Finalization of an Auction

The seller finalizes the auction by using the auction contract’s finalize
function. The auction contract determines the winning bidder on the highest
bids in the revealing phase, and the seller receives the funds. As a special
case, if the auctioned item is an NFT, the auction contract directly transfers
the NFT to the winning bidder right after the auction contract withdraws the
bidding price.777Unlike to NFT, if a smart contact does not treat an auctioned
item, then there is room for argument on whether exchange between the funds
and the auctioned item is honestly run. Thus, it seems reasonable to employ
fair exchange protocols, especially smart contract-based protocols [3, 12, 11,
20] in addition to our protocol.

###  III-E Security Discussion

We assume that all parties follow the protocol description (i.e., semi-honest
parties), and we do not introduce any trusted third party in our protocol.
Then, our protocol provides price hiding if the underlying commitment scheme
provides hiding, the DECO protocol provides zero-knowledge for hiding
balances, and our two assumptions hold: (1) bidding transactions to one-time
addresses and usual transactions are indistinguishable, and (2) the maximum
bidding price is not revealed for transactions during the bidding phase. We
discuss how much these assumptions are reasonable in Sections V-A and V-B.

Moreover, our protocol provides fund binding if the underlying commitment
scheme provides binding, the underlying signature scheme (run by the oracle)
is existentially unforgeable under chosen-message attack (EUF-CMA), and the
DECO protocol provides soundness for proving balances. Here, soundness means
that no proof for false statements (e.g., a balance is less than and not equal
to the bidding price) is accepted.

##  IV Implementation

###  IV-A Gas Prices for Running the Proposed Protocol

In this section, we discuss the fees of operating auctions. As mentioned in
Section II-A, we need to pay a fee called “gas” to operate a smart contract.
The gas and USD-denominated fees for bidders’ processing in the auction of the
proposed protocol are shown in Table I. This paper assumes that the gas price
is 45 gwei (median gas price on August
15888https://dune.xyz/queries/4294/11099) and 1 ETH is 3200 USD (Approximate
price on August 15999https://www.coingecko.com/en/coins/ethereum). Normally, a
bidder will perform each operation shown in Table I one by one at a time, so
the bidder will consume about 38.19 USD worth of ETH in a series of
operations. The amount of gas consumed varies depending on the length of the
salt. However it is considered within the margin of error due to the high
volatility of gas price and ETH prices. In addition, the fee for the series of
operations is independent of the number of bidders.

TABLE I: Cost of Gas for Bidder’s Operation (Proposed Protocol) Operation | Used Gas | Fee
---|---|---
Sending funds | 21,000 | 3.02 USD
Committing bid | 68,903 | 9.92 USD
Proving bid | 52,755 | 7.60 USD
Revealing bid | 122,546 | 17.64 USD

Next, the gas and fees for the seller’s operation are shown in Table II. The
gas is approximately 29.78 USD, although it varies depending on the length of
the information entered into the smart contract at the start of the auction.
For example, assuming an NFT auction, in addition to the gas shown in Table
II, additional gas required to send the NFT is also necessary.

TABLE II: Cost of Gas for Seller’s Operation (Proposed Protocol) Operation | Used Gas | Fee
---|---|---
Starting auction | 166,510 | 23.98 USD
Finalization auction | 40,312 | 5.80 USD

###  IV-B Comparison

First, we consider the simple deposit method. As described in Section I-A,
this method is problematic in that the maximum bidding price is exposed.
Therefore, we can examine the fee for hiding the maximum bidding price by
comparing the proposed protocol with the simple deposit method. Because the
fee depends on the amount of data stored in the smart contract and the amount
of computation, we implemented the simple deposit method on a smart contract
implemented in the proposed protocol without changing the structure of the
smart contract as much as possible. Table III shows the amount of used gas and
fee for operations performed by the bidder.

TABLE III: Cost of Gas for Bidder’s Operation (Simple Deposit Method) Operation | Used Gas | Fee
---|---|---
Committing bid | 110,928 | 15.97 USD
Revealing bid | 83,119 | 11.97 USD

As described in section IV-A, the fee for the proposed protocol is about 38.19
USD (265,204 gas). Thus, the increased fee for hiding the maximum bidding
price by the proposed method is about 10.25 USD (194,047 gas), and is about
37% more expensive than that of the simple deposit method. Note that we use
3.02 USD as a normal transfer of Ethereum costs in this paper.

Next, we compare the fees for the operation of the open-bid auction. As in the
deposit method, we implemented the open-bid smart contract without changing
the smart contract structure implemented in the proposed protocol as much as
possible. Table IV shows the gas used and fee for operations performed by the
bidder. The fee for bidding is approximately 10.24 USD, which is lower than
the fee for the sealed-bid auction. However, multiple bids are generally
placed in open-bid auctions. As a result, the sealed bid auction, which
requires only one operation, may lower the fees.

TABLE IV: Cost of Gas for Bidder’s Operation (Open-Bid) Operation | Used gas | Fee
---|---|---
Bidding | 71,137 | 10.24 USD

##  V Analyses of Assumptions

###  V-A How Much Bidding Transactions are Hidden

In this section, we consider how much bidding transactions are hidden. Because
the one-time address is issued by a 256-bit salt which is known only by the
bidder, it is difficult to guess the one-time address by others. In addition,
a bidding transaction to a one-time address and usual transactions in Ethereum
are indistinguishable because a one-time contract has not been deployed yet.
If malicious bidders want to find the bidding transaction, they can infer the
one-time address from the following properties.

  1. 1.

Addresses that do not transfer ETH to other addresses during the bidding
phase.

  2. 2.

Addresses that received ETH for the first time during the bidding phase.

The first property is clear from the fact that the one-time contract has not
been deployed yet in the bidding phase, and only the one-time contract, which
is deployed in the revealing phase, can withdraw the funds of the one-time
address. The second property is also clear from the fact that the one-time
address has not been used yet before the bidding phase. If there are only a
few candidate addresses, malicious bidders may be able to guess the bidding
price. To extract addresses that satisfy the two conditions, we used Google
Cloud BigQuery, which has access to all data of Ethereum transactions. The
number of addresses with two conditions is shown in Table V.

TABLE V: The Number of Addresses Satisfying the Two Conditions | Three Days | One Week | Two Weeks
---|---|---|---
0$\sim$0.1ETH | 45,575 | 99,193 | 177,796
0.1$\sim$0.5ETH | 15,837 | 34,939 | 63,656
0.5$\sim$1ETH | 4,148 | 9,481 | 17,766
1$\sim$10ETH | 5,670 | 12,597 | 23,052
10$\sim$50ETH | 772 | 1,751 | 3,307
50$\sim$100ETH | 125 | 262 | 464
100$\sim$1000ETH | 186 | 352 | 608
1000$\sim$ETH | 39 | 69 | 124
Figure 2: The Number of Addresses Meeting the Two Conditions (0.1 ETH to 10
ETH)

We consider cases of three days (August 13 to 15), one week (August 9 to 15),
and two weeks (August 2 to 15) as the bidding phase period. Assuming that the
bidding price in the auction is 0.1 to 0.5 ETH, Table V shows that there are
15,837 possible addresses in the three days case, 34,939 addresses in the one
week case, and 63,656 addresses in the two weeks case. Because the average
price of the NFTs is approximately $711 (0.22 ETH as of August 15, 2021), as
described in Section I-A, this assumption is reasonable. Figure 2 shows the
number of addresses with balance between 0.1 ETH and 10 ETH during two weeks
(August 2 to 15). We remark that in many auctions, bidders know the
approximate market price of an auctioned item, and can expect the range of
bidding price, i.e., it does not become much higher/lower than the market
price. For example, when an item is sold 0.125 ETH market price, then it seems
reasonable that the winning bid is between 0.1 ETH and 0.15 ETH. Thus, we
described the width of the graph in 1.25x intervals (between 0.1 and 0.125,
between 0.125 and 0.156, and so on) that seems appropriately treat the above
situation. Because all these addresses can be regarded as one-time addresses,
it is clear that a longer bidding phase period is effective in hiding more
one-time addresses.

###  V-B How Much the Maximum Bidding Price is Hidden

In the proposed protocol, the maximum bidding price is less than or equal to
the maximum balance of all addresses. However, many transactions for a
relatively high ETH are transferred every day on Ethereum. For example, when
we assume the bidding phase to be two weeks (August 2 to 15), the maximum
balance of all addresses is 146,223 ETH. It is potentially difficult to
determine which transaction is for the maximum bidding price. On the other
hand, in the case of a sealed-bid auction with the simple deposit method, the
maximum bidding price is revealed.

##  VI Conclusion

In this paper, we proposed a sealed-bid action protocol providing the fund
binding property. We introduced transactions for one-time addresses and
employed DECO protocol. We implemented our protocol and compared the protocol
with the simple deposit method. Although we have discussed how much bidding
transactions are hidden, there is a room for argument on this point. For
example, bidders may be able to estimate a rough maximum bidding price from
transactions that increased after the bidding phase. Alternatively, some
statistical analyses may distinguish or identify transactions for one-time
addresses or reveal the maximum bidding price. Thus, the statistical analysis
of these transactions could be conducted in a future work. We expect that our
blockchain-oriented technique could be a stepping stone for hiding
transactions.

Acknowledgment: This work was supported by JSPS KAKENHI Grant Numbers
JP21K11897 and JP22H03588.

## References

  * [1] B. Al-Sada, N. Lasla, and M. M. Abdallah, “Secure scalable blockchain for sealed-bid auction in energy trading,” in _IEEE ICBC_ , 2021, pp. 1–3.
  * [2] argentlabs, “argent-contracts,” 2021, https://github.com/argentlabs/argent-contracts.
  * [3] S. Avizheh, P. Haffey, and R. Safavi-Naini, “Privacy-preserving FairSwap: Fairness and privacy interplay,” _Proceedings on Privacy Enhancing Technologies_ , vol. 2022, no. 1, pp. 417–439, 2022.
  * [4] E. Ben-Sasson, A. Chiesa, C. Garman, M. Green, I. Miers, E. Tromer, and M. Virza, “Zerocash: Decentralized anonymous payments from bitcoin,” in _IEEE Symposium on Security and Privacy_ , 2014, pp. 459–474.
  * [5] E. Ben-Sasson, A. Chiesa, E. Tromer, and M. Virza, “Succinct non-interactive zero knowledge for a von neumann architecture,” in _USENIX Security Symposium_ , 2014, pp. 781–796.
  * [6] V. Buterin, “A next-generation smart contract and decentralized application platform,” 2015.
  * [7] I. Cascudo and B. David, “ALBATROSS: publicly attestable batched randomness based on secret sharing,” in _ASIACRYPT_ , 2020, pp. 311–341.
  * [8] B. Chen, X. Li, T. Xiang, and P. Wang, “SBRAC: Blockchain-based sealed-bid auction with bidding price privacy and public verifiability,” _Journal of Information Security and Applications_ , vol. 65, p. 103082, 2022.
  * [9] T. Constantinides and J. Cartlidge, “Block auction: A general blockchain protocol for privacy-preserving and verifiable periodic double auctions,” in _IEEE Blockchain_ , 2021, pp. 513–520.
  * [10] B. David, L. Gentile, and M. Pourpouneh, “FAST: Fair auctions via secret transactions,” in _ACNS_ , 2022, pp. 727–747.
  * [11] S. Dziembowski, L. Eckey, and S. Faust, “FairSwap: How to fairly exchange digital goods,” in _ACM CCS_ , 2018, pp. 967–984.
  * [12] L. Eckey, S. Faust, and B. Schlosser, “OptiSwap: Fast optimistic fair exchange,” in _ACM ASIACCS_ , 2020, pp. 543–557.
  * [13] H. S. Galal and A. Youssef, “Trustee: Full privacy preserving vickrey auction on top of ethereum,” in _WTSC_ , 2019, pp. 190–207.
  * [14] F. Hao and P. Zielinski, “A 2-round anonymous veto protocol,” in _Security Protocols_ , 2006, pp. 202–211.
  * [15] P. Hsu and A. Miyaji, “Verifiable M+lst-price auction without manager,” in _IEEE DSC_ , 2021, pp. 1–8.
  * [16] M. Kadadha, R. Mizouni, S. Singh, H. Otrok, and A. Ouali, “ _ABCrowd_ : An _A_ uction mechanism on _B_ lockchain for spatial _Crowd_ sourcing,” _IEEE Access_ , vol. 8, pp. 12 745–12 757, 2020\.
  * [17] A. E. Kosba, A. Miller, E. Shi, Z. Wen, and C. Papamanthou, “Hawk: The blockchain model of cryptography and privacy-preserving smart contracts,” in _IEEE S &P_, 2016, pp. 839–858.
  * [18] M. Król, A. Sonnino, A. G. Tasiopoulos, I. Psaras, and E. Rivière, “PASTRAMI: privacy-preserving, auditable, scalable & trustworthy auctions for multiple items,” in _ACM Middleware_ , 2020, pp. 296–310.
  * [19] H. Li and W. Xue, “A blockchain-based sealed-bid e-auction scheme with smart contract and zero-knowledge proof,” _Security and Communication Networks_ , vol. 2021, pp. 5 523 394:1–5 523 394:10, 2021.
  * [20] C. Lin, D. He, X. Huang, and K. R. Choo, “OBFP: optimized blockchain-based fair payment for outsourcing computations in cloud computing,” _IEEE Trans. Inf. Forensics Secur._ , vol. 16, pp. 3241–3253, 2021.
  * [21] B. Lorenz, C. Cachin, B. Chan, A. Coventry, S. Ellis, A. Juels, F. Koushanfar, A. Miller, B. Magauran, D. Moroz, S. Nazarov, A. Topliceanu, F. Tramer, and F. Zhang, “Chainlink 2.0: Next steps in the evolution of decentralized oracle networks,” 2021, https://research.chain.link/whitepaper-v2.pdf.
  * [22] J. Ma, B. Qi, and K. Lv, “Fully private auctions for the highest bid,” in _ACM TUR-C_ , 2019, pp. 64:1–64:6.
  * [23] G. Maxwell, “Confidential transactions,” 2016, https://web.archive.org/web/20200502151159/https://people.xiph.org/~greg/confidential_values.txt.
  * [24] M. Naor, B. Pinkas, and R. Sumner, “Privacy preserving auctions and mechanism design,” in _ACM EC_ , 1999, pp. 129–139.
  * [25] B. Parno, J. Howell, C. Gentry, and M. Raykova, “Pinocchio: Nearly practical verifiable computation,” in _IEEE S &P_, 2013, pp. 238–252.
  * [26] R. Pass, “Alternative variants of zero-knowledge proofs,” Tech. Rep., 2004.
  * [27] G. Sharma, D. Verstraeten, V. Saraswat, J. Dricot, and O. Markowitch, “Anonymous fair auction on blockchain,” in _IFIP NTMS_. IEEE, 2021, pp. 1–5.
  * [28] ——, “Anonymous sealed-bid auction on Ethereum,” _Electronics_ , vol. 10, no. 19, 2021.
  * [29] A. Sonnino, M. Król, A. G. Tasiopoulos, and I. Psaras, “AStERISK: Auction-based shared economy resolution system for blockchain,” _CoRR_ , vol. abs/1901.07824, 2019.
  * [30] D. Unruh, “Computationally binding quantum commitments,” in _EUROCRYPT_ , 2016, pp. 497–527.
  * [31] I. Vakilinia, S. Badsha, and S. Sengupta, “Crowdfunding the insurance of a cyber-product using blockchain,” in _IEEE UEMCON_ , 2018, pp. 964–970.
  * [32] S. Wu, Y. Chen, Q. Wang, M. Li, C. Wang, and X. Luo, “CReam: A smart contract enabled collusion-resistant e-auction,” _IEEE Trans. Inf. Forensics Secur._ , vol. 14, no. 7, pp. 1687–1701, 2019.
  * [33] F. Zhang, D. Maram, H. Malvai, S. Goldfeder, and A. Juels, “DECO: liberating web data using decentralized oracles for TLS,” in _ACM CCS_ , 2020, pp. 1919–1938.