What it is
On a public blockchain, anything sent in a transaction is visible to everyone immediately, which is a problem for voting: if votes are visible as they arrive, later voters can see the running tally and vote strategically, copy the apparent winning side, or coordinate to sway a result. Commit-reveal voting fixes this by splitting voting into two phases — a commit phase where voters submit a scrambled, unreadable version of their choice, and a reveal phase afterward where they unscramble it, so no one can see any vote until all votes are locked in.
How it works
- During the commit phase, each voter computes a hash of their intended vote combined with a secret random value (a "salt" or "nonce") that only they know, and submits just that hash on-chain.
- Because a cryptographic hash reveals nothing about its input, observers (including other voters and any contract) see only meaningless-looking commitments, not actual votes, during this phase.
- The commit phase closes at a set block or time, locking in the set of participants and preventing anyone from adding a late vote after seeing others' behavior.
- In the reveal phase, each voter submits their original vote choice plus their secret salt; the contract re-hashes those two values and checks the result matches the commitment they submitted earlier.
- If the hash matches, the vote is counted as valid; if it doesn't match (or a voter never reveals), that vote is discarded or penalized, depending on the design.
- Once the reveal window closes, the contract tallies all successfully revealed votes and finalizes the outcome — often used in dispute-resolution or juror systems (like Aragon Court/Kleros-style courts) where jurors vote on which side of a dispute is correct, and staking/rewards are distributed based on voting with the eventual majority.
- Many implementations also slash or withhold rewards from voters who commit but never reveal, to discourage using the commit phase to reserve a spot without actually participating.
Why designers use it
- Prevents vote herding and last-mover advantage, where later voters would otherwise just copy the visible leading option instead of voting their honest view.
- Protects voters (especially in dispute/jury systems) from retaliation or bribery based on how they're seen to vote in real time.
- Makes it harder for an attacker to buy votes mid-process, since there's no visible tally to bribe against until it's too late to change anything.
- Improves the integrity of subjective judgment calls (like arbitration outcomes) where independent, non-coordinated judgment is the whole point.
Failure modes
- Low reveal rates: voters who commit but forget, get distracted, or find it not worth the gas to come back and reveal cause valid votes to be lost, sometimes changing the outcome or reducing quorum below what's needed.
- Griefing via non-reveal: a participant can commit to a vote just to occupy a slot or distort expected turnout, then deliberately not reveal, without much cost if the penalty is weak.
- The secret salt itself is a single point of failure — if a voter loses or forgets their salt before the reveal phase, they cannot prove their commitment and their vote is lost even if they remember what they voted.
- Two required transactions (commit, then reveal) double the gas cost and user friction, which suppresses turnout on cost-sensitive chains, especially among small stakeholders.
- Off-chain coordination can partially defeat the scheme: if a subset of large voters coordinate their vote choice privately outside the contract before committing, the anti-collusion benefit is undermined.
What to check before using it
- Verify the penalty for committing without revealing is strong enough to discourage griefing but not so strong it scares away legitimate voters worried about missing the reveal window.
- Check reveal-phase length and reminders/UX — if it's too short or easy to miss, expect meaningful vote loss purely from forgetfulness.
- Confirm the hash commitment includes a sufficiently random, unguessable salt; weak or predictable salts can let an attacker brute-force a committed vote before reveal.
- Model the gas cost of two transactions per voter against your expected participant base — this scheme is much more viable when turnout is small and stakes are large (e.g., professional jurors) than for mass token-holder votes.
- Decide what happens to quorum and outcome validity if a meaningful share of commits are never revealed.