> ## Documentation Index > Fetch the complete documentation index at: https://sealforge.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Overview > What sealForge is, the status of every component, the three guarantees stated precisely, and what is not guaranteed. sealForge runs **auditable sealed-bid auctions on Zcash: the clearing price is public, the bidders aren't.** A bid is one shielded payment to a per-auction escrow address. Its encrypted memo carries a salted commitment and a refund address. The escrow is a 2-of-3 FROST key generated by three trustees. After the auction closes, the organiser publishes the result and the escrow's incoming viewing key (UIVK). Anyone can then recompute the result from the chain. Refunds and the payout are 2-of-3 threshold spends of the escrow, built as PCZTs. ## Status One row per component. Labels are defined in the [docs index](https://sealforge.mintlify.site/index.md#status-labels). **No component has run on mainnet.** | Component | Status | Where it ran / evidence | | - | - | - | | Bid memo, commitments, selection, clearing, Merkle tree (`sealforge-core`) | `Testnet` | `KE5DFF4PDA`, `K7GHHBC4GP` ([06 Verification](https://sealforge.mintlify.site/verification.md#testnet-record)) | | Deposit mode (amount is the bid) | `Regtest` | [evidence/regtest-e2e.md](https://github.com/Udoka-AM/sealForge/blob/main/docs/evidence/regtest-e2e.md). Both testnet auctions used sealed-reveal mode | | Sealed-reveal mode (commit-reveal) | `Testnet` | `KE5DFF4PDA`, `K7GHHBC4GP` | | FROST 2-of-3 DKG through the coordinator relay | `Testnet` | Both testnet auctions. `dkg_e2e` | | Rerandomized FROST signing of Ironwood spends via PCZT | `Testnet` | Every refund and payout in both testnet auctions | | Refund planner (canonical notes, delays, mixed batches) | `Testnet` | `KE5DFF4PDA`: 19 notes / 2 tx. `K7GHHBC4GP`: 73 notes / 5 tx | | Independent chain audit, CLI (`sealforge-audit`) | `Testnet` | Both testnet auctions, against `testnet.zec.rocks` | | Independent chain audit, browser (WASM scanner + auditor over gRPC-web) | `Testnet` | `KE5DFF4PDA` | | Receipt inclusion check (`/verify`) | `Testnet` | `KE5DFF4PDA` bidder 3 | | In-browser wallet (`sealforge-wallet`, librustzcash in WASM) | `Testnet` | Private sealed auction `VRQA54RNWG` ([WALLET-INTEGRATION.md](https://github.com/Udoka-AM/sealForge/blob/main/docs/WALLET-INTEGRATION.md#verified-2026-10-17-testnet)) | | Embed widget (`apps/web/public/embed.js`) | `Tested` (manual) | No automated test | | ShieldRamp Linkability Score (`packages/shieldramp/src/score.ts`) | `Tested` | 2 unit tests | | ShieldRamp quote, swap leg and delayed bid | `Specified` | `/api/shieldramp/quote` returns 501/503 | | Protocol fee / take rate | `Specified` | No fee in code ([09 Product](https://sealforge.mintlify.site/product.md#revenue-models)) | | Mainnet operation | `Not built` (gated) | [10 Roadmap](https://sealforge.mintlify.site/roadmap.md) | ## The three guarantees Stated as what is hidden, from whom, and when. Each links to where it's enforced. 1. **Bidders are hidden from chain observers during the auction and after it.** A bid is a shielded Ironwood payment. The published UIVK decrypts incoming notes (amounts and memos), not senders. The refund address in each memo becomes readable after publish, so the bid flow asks for a fresh address per bid. See [2.1 Roles](https://sealforge.mintlify.site/protocol/roles.md) and [3 Zcash integration](https://sealforge.mintlify.site/zcash-integration.md#unified-addresses-ufvk-uivk). 2. **Bid amounts are hidden from chain observers during the auction.** In **sealed-reveal mode** the price is also hidden from the coordinator and trustees until the reveal window, though they see deposit sizes, which bound the price from above. In **deposit mode** the coordinator and trustees see amounts as bids arrive. After publish, every amount is public. See [2.4 Commitments](https://sealforge.mintlify.site/protocol/commitments.md) and [5 Security](https://sealforge.mintlify.site/security.md#trust-assumptions). 3. **Anyone can recompute the result from the chain** with only the published UIVK and a lightwallet server they choose. The auditor reclassifies every payment with the same `sealforge_core::selection` code the coordinator ran, then recomputes clearing and the Merkle root and compares every field. See [6 Verification](https://sealforge.mintlify.site/verification.md). ## What it doesn't guarantee * **Bidder behaviour at the exit.** A bidder who moves all refund notes out at once recreates their refund amount ([2.7 Refund privacy](https://sealforge.mintlify.site/protocol/refunds.md#known-residuals)). * **Source-chain privacy for ShieldRamp.** Not built. EVM-side deposits are public. * **Coordinator and organiser liveness.** Refunds need the organiser to publish, the coordinator to build transactions, and two trustees to sign. Any of them can delay ([5 Security](https://sealforge.mintlify.site/security.md#trust-assumptions)). * **Protection against a malicious coordinator at refund time.** Trustees sign the sighash the coordinator gives them without seeing the transaction, so they can't detect a spend that pays the wrong place. One rogue trustee can't move funds; a rogue coordinator plus two trustees signing as instructed can. Closing this is a mainnet gate ([5 Security](https://sealforge.mintlify.site/security.md#trust-assumptions)). * **Operator blindness in deposit mode** ([5 Security](https://sealforge.mintlify.site/security.md#trust-assumptions)). ## Ninety seconds 1. Open a finished testnet auction: \<[https://sealforge.udokaam.dev/a/KE5DFF4PDA>](https://sealforge.udokaam.dev/a/KE5DFF4PDA>). 2. Open its audit page, \<[https://sealforge.udokaam.dev/audit/KE5DFF4PDA>](https://sealforge.udokaam.dev/audit/KE5DFF4PDA>), and press **Rescan the chain in my browser**. Your browser fetches the blocks over gRPC-web from a lightwallet server you choose, decrypts them with the published UIVK in WebAssembly, and recomputes the result. 3. Or from a terminal: `sealforge-audit --published https://sealforge.udokaam.dev/api/auctions/KE5DFF4PDA/result --endpoint https://testnet.zec.rocks:443` (see [6 Verification](https://sealforge.mintlify.site/verification.md#audit-any-auction)). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.