Announcing the Zama Public Auction

December 1, 2025

—

Rand Hindi

One of the biggest challenges in launching a protocol is deciding how to distribute and price its token. Over the years, projects have tried everything—from fixed-price sales to airdrops to direct listing. After studying more than a hundred TGEs, we found that auctions offer the best balance of fair distribution, price discovery, and capital efficiency.

Today, we are excited to announce that @zama will sell 10% of the $ZAMA token supply through a sealed-bid Dutch auction, using Zama itself to keep participant bids confidential. This ensures that Zama users, developers, and operators can purchase tokens at a price they believe is fair, regardless of Zama’s previous funding rounds.

In a Dutch auction, the clearing price isn’t the highest bid—it’s the lowest price at which a bid gets filled. This makes Dutch auctions a powerful mechanism for token launches, with better distribution and more accurate price discovery. Dutch auctions have been used throughout history: by ancient Greeks to sell cattle; by eBay for second-hand electronics; by Google for its IPO; by the New York Federal Reserve for bond sales; and, of course, by the Dutch for everything from paintings to real estate to crops.

Confidentiality is a critical part of dutch auctions. When participants can see others’ bids, they can manipulate the outcome, and price discovery becomes distorted as people react to one another rather than bidding what they truly believe the item is worth. Here is a great video explaining why the “wisdom of the crowd” only works when predictions are independent and confidential. This makes Zama the perfect solution for launching tokens through auctions, but also for other use cases that require independent inputs, such as prediction markets, elections or polls.

The Zama auction will run from January 12th–15th, with claiming on January 20th. Tokens purchased in the auction will be fully unlocked and immediately usable in the Zama Protocol—whether for paying encryption and decryption fees, staking as an operator, or delegating to existing operators to help secure the network.

This makes the Zama auction one of the first “post-sale”, taking place after mainnet launch, not before. Mainnet is expected to launch by the end of the year, with the $ZAMA token minted and fully functional.

You can pre-register now at auction.zama.org. It’s a good idea to get in early and share with your friends!

The Zama Protocol

The Zama Protocol adds a layer of confidentiality to existing public blockchains. It uses Fully Homomorphic Encryption (FHE) to keep transaction data and onchain state encrypted while still allowing smart contracts to be executed on it.

Zama is not a new L1 or L2. It operates on top of existing chains, meaning any token or smart contract can be converted into a confidential version without bridging to a new network. If you hold stablecoins on Ethereum, for example, you can upgrade them to confidential stablecoins whose balances and transfer amounts remain encrypted, while still being on Ethereum. These confidential tokens can be confidentially transferred, swapped, or staked, just like regular tokens. Zama is essentially HTTPS for blockchain.

The $ZAMA utility token plays a central role in the protocol. It is used to pay for encryption and decryption, as well as reward operators and stakers for running and securing the network. All fees are burned, while rewards are minted following a yearly emission schedule.

You can read our litepaper to learn more about the protocol and token.

How the Zama auction works

The Zama auction is a single-price, sealed-bid dutch auction running on Ethereum mainnet, using Zama itself to keep bids confidential. The auction runs in four phases:

Phase 1 — Shield stablecoins

When: Anytime after mainnet launches

Participating in the Zama auction requires confidential stablecoins on Ethereum, which you get by shielding USDC, USDT, or DAI. You can shield tokens directly in the auction app or through wallets such as Bron.org.

Behind the scenes, shielding deposits your ERC-20 stablecoins into a wrapping contract and issues you the equivalent amount of ERC-7984 tokens, whose balances and transfer amounts are encrypted. While shielding is visible onchain, any transfer you make from that moment will be fully confidential. As such, we recommend shielding more tokens that you intend to bid with.

Importantly, shielding does not lock funds into the auction contract. Your confidential stablecoins remain in your Ethereum wallet and can be used just like regular stablecoins for payments and anything outside the auction.

Phase 2 — Place your bids

When: January 12th–15th

Once the auction starts, you will have four days to place your bids. Each bid includes a price and a quantity of $ZAMA tokens you want to buy. The price is public, but the quantity is private—nobody can see whether you’re bidding for 1 or 1,000 tokens at that price. You can submit as many bids as you like, at any price, and cancel them at any time during the auction.

Prices are in increments of $0.005, corresponding to a $55M FDV (based on a total supply of 11B tokens). The auction floor is therefore $55M FDV. There are no caps on price or bid size however: as long as you have sufficient confidential stablecoins, you can bid for any amount.

Unlike public dutch auctions where the price drops over time, sealed-bid auctions let you place bids at any price throughout the bidding period. This eliminates the race conditions and gas wars that typically favors larger bidders. If gas is high, you can simply wait to submit your bids later.

Because bids are private and not time-dependent, bots cannot monitor the mempool, front-run bids, or attempt last-second sniping. Humans and AI are on equal footing.

Bids can be placed through the Zama app using any EVM wallet, or through one of our partner platforms. Bids placed though one of our partners will be included in exactly the same way as bids placed on the Zama app itself. This offers more options for retail participants, which in turns improves distribution. We will announce supported platforms in the coming weeks.

Phase 3 — Clearing price and allocation

When: January 16th–19th

After the auction closes, bids are filled from highest price to lowest. The lowest price at which a bid is filled becomes the clearing price. All participants who successfully bid above that price will thus end up paying the same clearing price. The entire calculation is performed using FHE.

There are three possible outcomes:

Bid above the clearing price: You receive your full allocation and a refund for any overpayment.
Bid at the clearing price: If quantity exceeds remaining supply at that exact price, you receive a pro-rata share of tokens and a refund for the remainder.
Bid below the clearing price: You receive no tokens and get a full refund.

This mechanism prioritizes distribution quality and price discovery rather than maximizing FDV or total sale amount. To ensure even broader distribution, 8% of the total supply will be sold through the auction, while the remaining 2% will be sold in a fixed-price sale immediately afterward at the same clearing price, but capped at $10k per participant.

We also have surprises for Zama OG NFT holders, some of which are auction related, some of which are not 😉.

Phase 4 — Claim your tokens

When: January 20th

Once allocations are finalized, participants can claim both their $ZAMA tokens and refund. $ZAMA will be distributed as standard ERC-20 tokens, and refunds can be claimed either as ERC-20 or as confidential ERC-7984.

All claimed tokens are fully unlocked and can be spent, transferred, staked or delegated to operators immediately.

Make sure to join our mailing list at auction.zama.org to be the first to know when registration and shielding opens!

Cheers,
Rand

Annex: Example auction

Imagine there are 1,000 $ZAMA tokens to be sold, and that you have three people bidding, Alice, Bob and Charlie.

Bidding phase

Alice bids 400 tokens at a price of $5 each. She pays $2,000 for it.
Bob bids 600 tokens at a price of $4 each. He pays $2,400 for it.
Charlie bids 300 tokens at a price of $3 each. He pays $900 for it.

Clearing price and allocation

At the end of the bidding period, the auction smart contract goes from the highest bid price to the lowest price to allocate tokens to each participant:

Alice is the highest bidder. She gets her 400 tokens. There are 600 tokens left to allocate.
Bob is the second highest bidder. He gets his 600 tokens. There are 0 tokens left to allocate. As such, the clearing price is what Bob bid at, i.e. $4 per token.
Charlie’s bid is under the clearing price, and thus he receives no allocation.

Claiming tokens and refunds

Now that the clearing price is defined, Alice, Bob and Charlie can claim their tokens and refund:

Alice receives 400 $ZAMA token and a refund for $400 USD, corresponding to the difference between what she paid at $5 per token and the clearing price of $4 per token.
Bob receives 600 $ZAMA tokens and no refund, as he paid exactly the clearing price.
Charlie gets no $ZAMA tokens and a full refund of $900 USD.

Latest Blog Posts

Developer Program December 2025 - Join the Pre-Mainnet Builder Cohort

Announcements

Your chance to join the last pre-mainnet cohort of developers building on the Zama Protocol via the Developer Program.

Creator Program Season 5 - The Last Chance To Be the First

Announcements

Season 5 reserves the final 1,000 OG spots for creators. It's your last chance to be the first!

Bounty Track December 2025: Build The FHEVM Example Hub

Announcements

Build a set of standalone, Hardhat-based FHEVM example repositories, each demonstrating one clear concept.

Read more →

Back to blog

Privacy is necessary for an open society in the electronic age. Privacy is not secrecy. A private matter is something one doesn't want the whole world to know, but a secret matter is something one doesn't want anybody to know. Privacy is the power to selectively reveal oneself to the world.If two parties have some sort of dealings, then each has a memory of their interaction. Each party can speak about their own memory of this; how could anyone prevent it? One could pass laws against it, but the freedom of speech, even more than privacy, is fundamental to an open society; we seek not to restrict any speech at all. If many parties speak together in the same forum, each can speak to all the others and aggregate together knowledge about individuals and other parties. The power of electronic communications has enabled such group speech, and it will not go away merely because we might want it to.Since we desire privacy, we must ensure that each party to a transaction have knowledge only of that which is directly necessary for that transaction. Since any information can be spoken of, we must ensure that we reveal as little as possible. In most cases personal identity is not salient. When I purchase a magazine at a store and hand cash to the clerk, there is no need to know who I am. When I ask my electronic mail provider to send and receive messages, my provider need not know to whom I am speaking or what I am saying or what others are saying to me; my provider only need know how to get the message there and how much I owe them in fees. When my identity is revealed by the underlying mechanism of the transaction, I have no privacy. I cannot here selectively reveal myself; I must always reveal myself.Therefore, privacy in an open society requires anonymous transaction systems. Until now, cash has been the primary such system. An anonymous transaction system is not a secret transaction system. An anonymous system empowers individuals to reveal their identity when desired and only when desired; this is the essence of privacy.Privacy in an open society also requires cryptography. If I say something, I want it heard only by those for whom I intend it. If the content of my speech is available to the world, I have no privacy. To encrypt is to indicate the desire for privacy, and to encrypt with weak cryptography is to indicate not too much desire for privacy. Furthermore, to reveal one's identity with assurance when the default is anonymity requires the cryptographic signature.We cannot expect governments, corporations, or other large, faceless organizations to grant us privacy out of their beneficence. It is to their advantage to speak of us, and we should expect that they will speak. To try to prevent their speech is to fight against the realities of information. Information does not just want to be free, it longs to be free. Information expands to fill the available storage space. Information is Rumor's younger, stronger cousin; Information is fleeter of foot, has more eyes, knows more, and understands less than Rumor.We must defend our own privacy if we expect to have any. We must come together and create systems which allow anonymous transactions to take place. People have been defending their own privacy for centuries with whispers, darkness, envelopes, closed doors, secret handshakes, and couriers. The technologies of the past did not allow for strong privacy, but electronic technologies do.We the Cypherpunks are dedicated to building anonymous systems. We are defending our privacy with cryptography, with anonymous mail forwarding systems, with digital signatures, and with electronic money.Cypherpunks write code. We know that someone has to write software to defend privacy, and since we can't get privacy unless we all do, we're going to write it. We publish our code so that our fellow Cypherpunks may practice and play with it. Our code is free for all to use, worldwide. We don't much care if you don't approve of the software we write. We know that software can't be destroyed and that a widely dispersed system can't be shut down.Cypherpunks deplore regulations on cryptography, for encryption is fundamentally a private act. The act of encryption, in fact, removes information from the public realm. Even laws against cryptography reach only so far as a nation's border and the arm of its violence. Cryptography will ineluctably spread over the whole globe, and with it the anonymous transactions systems that it makes possible.For privacy to be widespread it must be part of a social contract. People must come and together deploy these systems for the common good. Privacy only extends so far as the cooperation of one's fellows in society. We the Cypherpunks seek your questions and your concerns and hope we may engage you so that we do not deceive ourselves. We will not, however, be moved out of our course because some may disagree with our goals.The Cypherpunks are actively engaged in making the networks safer for privacy. Let us proceed together apace.Onward.Eric Hughes9 March 1993