Handshake name auctions, explained from your phone

Handshake names sell by sealed-bid Vickrey auction: you pay the second-highest bid. The block windows, how blinds work, and why a lost nonce isn't fatal.

5 August 2026 · 7 min read

Handshake doesn’t sell names first-come-first-served, and it doesn’t run an eBay-style visible auction. Every name is allocated by a sealed-bid Vickrey auction: bids are hidden while bidding is open, and the winner pays the second-highest bid rather than their own.

That format is deliberate. It means bidding your honest maximum is the rational move — you can’t be punished for it, because you’ll pay whatever the runner-up was willing to pay, not what you wrote down. It also means the mechanics involve some cryptography you’d rather your wallet handled for you. Here’s what’s happening underneath.

The timeline, in blocks

Every phase of a Handshake auction is measured in blocks, not days. On mainnet:

Phase	Length	Roughly
Open period (after OPEN confirms)	37 blocks	~6 hours
Bidding	720 blocks	~5 days
Reveal	1,440 blocks	~10 days
Whole auction	2,197 blocks	~15 days

The open period is 37 blocks because it’s Handshake’s tree interval (36 blocks) plus one — the OPEN has to settle into the name tree before bids can reference it. Days are approximate at the 10-minute target block spacing; blocks are what consensus counts.

Two consequences of that fixed 2,197-block lifetime are worth knowing:

A name in any auction phase was opened within the last 2,197 blocks. So scanning that window back from the chain tip yields the complete set of open auctions — not a sample, not whatever an indexing service chose to show you. That’s how Tilde builds its browse list without asking anyone’s API.
Deadlines are hard. There is no “sorry, I was travelling” in consensus.

When you bid, your wallet publishes a BID covenant that contains the name and a blind — a BLAKE2b-256 hash of your bid amount (as a 64-bit little-endian value) concatenated with a 32-byte nonce. The amount itself is not on chain. The blind is a commitment: later you’ll prove what you bid by revealing the amount and the nonce, and anyone can re-hash them and confirm they match.

The output value of your BID transaction is the lockup, and it can be larger than your real bid. The difference is a decoy: an observer sees you locked up 1,000 HNS, but you may have bid 60. Consensus enforces only that the lockup is at least the true bid, and the excess comes back to you at reveal time.

What is public during bidding: the name, the number of bids on it, and each bid’s lockup amount. What isn’t: what anyone actually bid.

Revealing: the deadline that costs people money

When bidding closes, the reveal window opens for 1,440 blocks. You spend your BID outputs with a REVEAL covenant that carries the true amount and the nonce.

An unrevealed bid’s lockup is lost permanently once the reveal window closes. Not delayed, not clawed back later — the coins are locked in an output that can only ever be spent by a REVEAL, and REVEAL is only valid inside the window. This is the single most expensive mistake in Handshake, and it’s why Tilde reveals every bid on a name in one transaction rather than making you handle them individually, and why reveal deadlines get notifications rather than a badge you might not see.

After reveals settle:

If you lost, you send a REDEEM to recover your locked value. Losing costs you transaction fees, nothing more.
If you won, you send a REGISTER, which is where the Vickrey part becomes real money: the REGISTER output locks the second-highest revealed bid, and the rest of your revealed value returns to you as change. You also attach your initial DNS records in the same covenant, so the name can resolve the moment it’s yours.

One consensus detail that cost us a live registration before we understood it: the REGISTER output must pay the reveal coin’s own address. hsd’s covenant rules require the addresses to match; paying a fresh receive address — even your own — is a deterministically invalid transaction that every node rejects. The same “stay on the same address” rule applies to UPDATE, RENEW and TRANSFER. Only FINALIZE pays a different party.

Why a lost bid record isn’t fatal

If a blind’s nonce is lost, the naive outcome is catastrophic: you can never reveal, so your lockup is gone at the end of the window. Wallets that generate random nonces and store them in one place are one backup failure away from exactly that. We know, because it happened to us in July 2026 — a change to the app’s keychain access group orphaned the stored blind for a live bid.

The fix is that nonces don’t have to be random. hsd derives them deterministically from the wallet’s own key material: a child of the account key at an index folded from the bid value, hashed together with the bid address and the name hash. Tilde derives them the same way, byte-for-byte, pinned by test vectors generated from hsd itself.

The practical consequence: your seed phrase plus the exact bid amount re-derives the nonce. The stored record is a convenience cache, not the sole custodian of your money. If it’s missing, the reveal flow offers recovery from the amount, and every candidate nonce is checked against the blind hash that’s already on chain before it’s used. Tilde also shows each bid’s nonce with a copy button, so you can keep an out-of-band copy if you want one.

The bid records themselves are also treated differently from your seed: at every security tier they’re eligible for encrypted iCloud backup, because they’re worthless after the reveal window and losing them is worse than backing them up. That’s a deliberate, stated divergence from how the seed is handled — see the security page.

Doing all this from a phone

None of the above requires a desktop. It requires a wallet that (a) knows the block deadlines, (b) can build seven different covenant types correctly, and (c) puts the deadlines in front of you.

Tilde carries the whole lifecycle: search names offline against a bundled index of live names, browse the complete open-auction set, OPEN a name, bid with a lockup mask, reveal, redeem, register with DNS records, and renew. Our own name, tildewallet/, was won from the app — and the site you’re reading is served at that name as well as at tildewallet.com.

Questions people actually ask

What do I actually pay if I win?

The second-highest revealed bid, not your own bid. The difference between what you revealed and what you owe comes back to you as change on the REGISTER transaction. Check the amount owed on the auction screen before registering — with few revealed bids, the second price can be far below what you bid.

What if I forget to reveal?

Your locked-up bid is unrecoverable. This is the outcome the app works hardest to prevent: reveal windows are 1,440 blocks (~10 days), and you get notified.

Can other people see what I bid?

Not during bidding. They see the name, that a bid exists, and the lockup amount — which you can deliberately inflate above your real bid. Everything becomes public at reveal, as it must for the auction to be verifiable.

Can I bid on a name someone already owns?

No. Bidding applies to names in an auction. A registered name can only change hands if its owner transfers or sells it, or if it expires — see how renewals work.

Is the auction fair if the winner sets the price?

The winner doesn’t set the price; the runner-up does. That’s the point of a second-price auction, and it’s verifiable after the fact: every revealed bid is on chain, so anyone can recompute the price the winner paid.