Implement a Commit-Reveal Randomness Scheme for Front-Running-Resistant Auction Tie-Breaking

[Emmyt24]

Description

burn_auction.rs/buyback.rs resolve tied bids using ledger-derived pseudo-randomness, which a validator or a well-positioned bidder can predict or influence — a commit-reveal scheme removes that manipulation surface for tie-breaking.

Requirements and Context

• Implement a commit-reveal scheme: bidders submit a hashed commitment during the bidding window, then reveal the pre-image during a separate reveal window before tie-breaks are resolved
• Bids that are committed but never revealed must be excluded from tie-break resolution and must not receive a refund advantage over honest revealers — define and enforce the forfeiture rule
• The final tie-break randomness must be derived from the combination of all valid reveals so no single participant can unilaterally determine the outcome
• Enforce strict window timing: reject a commit after the bidding window closes and a reveal outside the reveal window
• Proof of work (required): this is a hard/complex issue — the PR description must include (1) a screenshot of the full relevant test suite run showing all tests passing, and (2) a screenshot of a successful project/module build or compile (cargo build --release) with no errors. PRs missing either screenshot will not be reviewed.

Suggested Execution

Branch: feat/contract-commit-reveal-auction-tiebreak

Implement Changes

• Add commit and reveal entry points with window-enforced timing
• Implement the combined-reveal randomness derivation (e.g. hash-chain of all revealed values) used only for tie-breaking, not for auction outcome itself
• Implement and test the non-reveal forfeiture rule explicitly
• Add tests: honest multi-bidder tie-break, a bidder who commits but never reveals, and an attempted late reveal

Test and Commit

Run cargo test commit_reveal --package token-factory — honest tie-break, non-reveal forfeiture, and late-reveal rejection all pass. Then run cargo build --release and confirm it completes with no errors. Attach a screenshot of both the passing test run and the successful build to the PR description as proof of work.

Example Commit Message

feat(contracts): commit-reveal randomness scheme for front-running-resistant auction tie-breaking

Closes #<issue>

Guidelines

• Branch from main, open a PR back to main
• All new code must have corresponding tests
• Run npm run lint and npm run test before pushing
• Follow existing naming conventions and file structure
• PR description must reference this issue number (e.g., Closes #<issue>)
• Keep commits atomic and use conventional commit format
• This is a hard/complex issue: PR must include a screenshot of the test suite passing and a screenshot of a successful build/compile — PRs without both screenshots will be marked incomplete and not merged