Commit-reveal voting

Why commit-reveal exists

Group evaluation has two chronic failure modes. Anchoring is when reviewers see someone else's score first and unconsciously adjust their own to match it. Herding is the same problem compounded: once the first few reviewers agree, later ones feel social pressure to fall in line.

Both effects collapse the variance of a panel's scores toward whoever votes first, destroying the statistical value of having multiple reviewers in the first place. Commit-reveal voting solves this by making it physically impossible to see anyone else's score until everyone has committed.

The protocol

A vote moves through three phases. At the end, the consensus score is calculated and every expert's reputation is updated based on their alignment with that consensus.

1. Commit phase

Your client computes a hash of your score concatenated with a random nonce. The hash is submitted to the on-chain contract along with your wallet signature. Your browser stores the nonce in local storage only — it never leaves your device during commit.

Other experts can see that you committed (your wallet address appears in the application's commit list) but they cannot see your score. They only see a hash, which is information-theoretically useless without the nonce.

2. Reveal phase

After the commit window closes, the reveal window opens. You come back to the application page and click Reveal. The client reads your saved nonce and score, and calls the reveal function on the contract.

The reveal is the only moment you're exposed — once you've clicked it, your score is public to the guild. Until then, nobody has any signal about your vote.

3. Finalization

When every expert has revealed (or the reveal window expires), finalization runs. The backend gathers all revealed scores, filters outliers using interquartile-range math, computes the consensus score (average of included scores), and classifies each expert's alignment.

Try it yourself

The demo below walks through a mock review — you score a fictional candidate, commit blind, reveal, and see how your choice maps to consensus and reputation. Nothing here touches the real app or your reputation.

How consensus is calculated

Vetted uses an IQR-based filter rather than a simple mean or median. Here's the exact procedure:

1. Collect every revealed score for the application.
2. Calculate the first quartile (Q1), third quartile (Q3), and interquartile range (IQR = Q3 − Q1).
3. Build an inclusion band around the median: [median − 0.75 × IQR, median + 0.75 × IQR]. Scores outside this band are excluded.
4. The consensus score is the average of the remaining scores.

Using the average of the filtered set rather than a raw average of everything means one wild score (either honest mistake or bad-faith) cannot swing the consensus away from where the bulk of experts landed. The IQR filter excludes outliers first, then the average of the remaining scores gives a stable consensus.

Alignment tiers

Your reputation change is determined by how far your score landed from the consensus, measured in IQR units. Two tiers:

The tiers are deliberately lopsided: being aligned earns you a meaningful boost; being wrong costs you more. This matches the underlying economics — one bad reviewer with no downside can consistently bias hiring outcomes, so bad-faith reviewing has to cost real money.

If you lose your nonce

The nonce only exists in your browser. If you clear local storage, switch devices, or use a private window during the commit, you won't be able to reveal.

There is a manual recovery path — contact the guild admin, who can mark your vote as abstained for that cycle. You won't earn or lose reputation on the affected vote, but you will count as inactive for that review, which contributes to long-term decay if it happens repeatedly.