Skip to content
Financial Context Wiki

Private transaction RPC

A private transaction RPC routes a signed transaction or bundle to a limited provider, relay or builder set before public mempool gossip; it changes initial disclosure, not execution validity, inclusion, price or finality guarantees.

Updated

For educational purposes only; not investment advice. Private routing can fail, leak transaction intent, or produce adverse execution and irreversible loss.

Direct answer

A private transaction RPC sends a signed transaction or ordered bundle to a limited service path before public mempool gossip. The path may include an RPC provider, relay, selected builders and, for disclosed hints, searchers. “Private” therefore describes initial distribution, not encryption, anonymity or invisibility to intermediaries.

The service can reduce exposure to public-mempool copying, front-running or sandwiching, but it does not guarantee inclusion, EVM success, best execution, an MEV refund or finality. A provider acknowledgement or returned transaction hash proves only that a request reached that interface. Builder distribution, payload selection, block inclusion, receipt status, canonicality and finality are separate states.

Do not treat all private methods as interchangeable. A single eth_sendPrivateTransaction, a legacy eth_sendBundle and an mev_sendBundle can differ in target blocks, ordered bodies, allowed reverts, replacement or cancellation, builder selection, privacy hints and refund rules. The exact chain, endpoint, API version and signed payload control the result.

How it works

The wallet first constructs and signs an ordinary chain transaction with a chain ID, nonce, destination, value, calldata, gas limit and EIP-1559 fee caps. Private routing changes where those signed bytes are submitted; it does not bypass nonce ordering, balance and allowance checks, contract execution, base-fee rules or consensus validation. Rebroadcasting identical signed bytes preserves the transaction hash, while a same-nonce replacement with changed fees or calldata has a different hash.

The provider may simulate the payload against a named state and distribute it to one or more builders. Simulation is conditional on that state: balances, storage, oracle values, competing transactions and base fee may change before construction. A builder may omit a valid transaction because it arrived late, paid too little, lost to a more valuable block or never reached the builder selected by the proposer.

Bundles add ordered execution policy. A required revert can make a bundle ineligible, while an explicitly allowed revert can consume gas and leave earlier successful bundle state changes in place. That is not automatic all-or-nothing rollback. Privacy hints can disclose a transaction hash, contract address, function selector, calldata or logs; a fast or broad builder mode increases reach and usually enlarges the trust and disclosure set.

Nonce and timeout handling require an explicit state machine. A private pending transaction may be absent from an ordinary public-RPC pending view and can block later nonces. Provider cancellation only stops future submission through paths it controls; it cannot recall a copy already shared, publicly broadcast or included. A same-nonce replacement or public fallback races every surviving version and reintroduces public order-flow exposure.

Use this workflow:

  1. Pin the chain ID, provider and API version; choose a single private transaction or bundle method and document provider logging, builder or searcher distribution, privacy hints, revert, refund and public-fallback policies.
  2. Decode the exact unsigned intent and signed payload: sender, nonce, destination, value, calldata, allowances, gas limit, fee caps, deadline, minimum output, target block range and every ordered bundle item.
  3. Simulate against an identified block and state; test success and revert paths, state drift, slippage, balance changes, allowed failures, total gas and the worst economically valid outcome.
  4. Submit through the intended endpoint and preserve the transaction or bundle hash, request ID, authentication identity, timestamp, target or maximum block, builders, hints and original payload.
  5. Monitor provider acknowledgement, simulation, builder distribution, private nonce and expiry separately from the canonical receipt; refresh target and fee assumptions before resubmission.
  6. At the deadline, explicitly choose to wait, cancel, replace with the same nonce or disclose through a public fallback; never assume cancellation recalls copies or send conflicting versions without tracking the race.
  7. Reconcile the correct-chain receipt status, logs, balances, output, effective gas price and refund, then wait for the required safe or finalized state and investigate reorgs, leakage or unexplained execution differences.

Examples

  • Output protection is not best execution. A swap quotes 100,000 USDC input with 98,800 USDC minimum output. Public execution returns 98,950 USDC, a 1,050 USDC or 1.05% shortfall from par, but only 150 USDC above the minimum. Private routing may reduce observation; it does not guarantee a better output than another public venue or RFQ.
  • EIP-1559 inclusion limit. A transaction uses 180,000 gas, base fee is 30 gwei, priority cap is 2 gwei and max fee is 40 gwei. Effective price is min(40, 30 + 2) = 32 gwei, so fee is 180,000 x 32 = 5,760,000 gwei = 0.005760 ETH. If a candidate block’s base fee is 42 gwei, the 40 gwei max fee cannot cover it and private routing cannot make the transaction includable there.
  • Same-nonce fallback race. Private payload A and public fallback B both use nonce 42. Two submissions exist, but the canonical chain can consume nonce 42 only once. If A lands at block N + 2, B becomes stale; if B lands first, A becomes stale. A cancellation acknowledgement is not an undo and every surviving copy must be tracked.
  • Allowed revert is not atomic rollback. In an ordered bundle, approval uses 45,000 gas and a swap reverts after 120,000 gas at an effective 25 gwei. Without an allowed-revert rule, the bundle is excluded under the stated policy. If the swap is allowed to revert and the bundle is included, the approval can persist, the swap has status = 0, and gas cost is (45,000 + 120,000) x 25 gwei = 0.004125 ETH.

Risks

  • The wallet uses the wrong chain, provider, endpoint or API version.
  • DNS, TLS, an API key or the RPC interface is phished or compromised.
  • The provider correlates IP, account, timing and signed payload data.
  • A relay logs, leaks, copies or rebroadcasts the full transaction.
  • Privacy hints disclose a hash, selector, contract, calldata or logs.
  • Fast mode or broad builder fanout enlarges the trust and disclosure set.
  • A builder or searcher censors, copies or exploits private order flow.
  • Simulation uses the wrong block or becomes stale before construction.
  • Contract state, balances, prices or ordering change and cause a revert.
  • Base fee, max fee or priority fee makes the payload unattractive or invalid.
  • A nonce gap or invisible private pending transaction blocks later nonces.
  • Cancellation or same-nonce replacement loses a timing race.
  • Silent public fallback restores public-mempool MEV exposure.
  • Target block, maximum block, timestamp or service TTL is misunderstood.
  • Bundle order or allowed-revert policy leaves an unintended state change.
  • Builder, relay, proposer coverage or censorship prevents inclusion.
  • Provider outage, rate limiting or latency misses the valid window.
  • Private routing is mistaken for slippage protection or best execution.
  • Receipt status, logs, balances, fees or refunds are reconciled incorrectly.
  • A reorg, premature finality assumption or L2 sequencer boundary reverses the conclusion.

Common misconceptions

  • Private means encrypted, anonymous and unseen. The provider and selected downstream parties may see the full payload or disclosed hints.
  • A private RPC guarantees no MEV and the best price. It changes distribution; contractual limits, venue comparison and execution quality still matter.
  • RPC success or a transaction hash means included, successful and final. Acknowledgement, receipt, EVM status and finality are different states.
  • Cancellation or a same-nonce replacement is guaranteed. Copies and competing versions race until one is included or all expire.
  • A private transaction is automatically an atomic bundle. Single transactions and multiple bundle formats have different ordering and revert semantics.

Sources

Navigation

Search the wiki...