How Preflop sets a defensible primary-market price

Four primary-market mechanisms were considered and rejected. Understanding what fails matters because the design choices below are direct fixes for those failure modes.

Preflop’s mechanism is built to fix every one of these failures simultaneously.

Phase 1 — Pre-indication disclosure (T-4 weeks)

• —Issuer disclosure pack published
• —Engine V_HC bands (low, mid, high) frozen and posted
• —e_eff computed for the proposed (s, T) tuple, posted
• —Reserve published: $P_{\text{reserve}} = 0.80 \cdot V_{\text{HC}}^{\text{low}} \cdot e_{\text{eff}} / N$
• —κ ratio computed for issuer’s target — must be in eligible tier (see κ-tier table)

Phase 2 — Indication window (2 weeks)

• —Bidders submit sealed bids: $(p_i, q_i)$ = (price-per-token willing to pay, quantity desired)
• —Lagging aggregate demand at each price level published with 5-minute delay — enough to calibrate, not enough to snipe
• —Bids can be revised or withdrawn until 24h before clearing — after T-24h the book is fixed
• —Bidders can see their own bid status (active / cancelled / replaced) but not other bidders’ identities or per-bid quantities

Phase 3 — Clearing (single block)

• —Threshold decryption fires: all sealed bids revealed simultaneously
• —Clearing algorithm (next section) runs on the decrypted book
• —If valid: tokens minted at $P^*$; AON escrow releases; allocation table written on-chain
• —If invalid: AON escrow returns funds (per SEA Rule 15c2-4); listing enters a 30-day re-auction window or withdraws

The keystone math. Given a set of sealed bids $\{(p_i, q_i)\}_{i=1}^M$, supply $N = 10{,}000$, allocation cap $\bar\alpha = 20\%$, reserve $P_{\text{reserve}}$, and minimum-clear threshold $\underline n = 60\%\,N = 6{,}000$, the algorithm:

Step 1 · Aggregate demand curve

Demand at price $P$ is the sum of quantities from all bidders willing to pay at least $P$.

Step 2 · Cap-adjusted demand

Each bidder’s effective demand is capped at $\bar\alpha \cdot N = 2{,}000$ tokens regardless of how much they bid for. This is the structural fix to Ausubel demand-reduction.

Step 3 · Clearing price

The highest price at which cap-adjusted demand still meets the target supply (or the cap-adjusted reserve demand if undersubscribed at reserve).

Step 4 · Cleared quantity

Step 5 · Validity check

The auction is valid if and only if all three conditions hold:

• ✓$P^* \geq P_{\text{reserve}}$ — clears at or above reserve
• ✓$n^* \geq \underline n$ — clears at least 60% of supply
• ✓$D^{\text{cap}}(P_{\text{reserve}}) \geq \underline n$ — even at reserve, capped demand reaches the minimum

Step 6 · Allocation

For every bidder $i$ with $p_i > P^*$: filled to $\min(q_i,\,\bar\alpha \cdot N)$. For bidders at $p_i = P^*$: pro-rata allocation of the residual quantity until $n^*$ is exhausted. All winning bidders pay $P^*$ per token, regardless of their original bid (uniform-price property).

Why it matters —The validity conditions exist so that an auction either produces a price the issuer’s disclosure pack supports, or no clearing happens and funds return. There is no “clear at any price” mode.

Pure Dutch auctions clear at the lowest accepted bid — same property as uniform-price — but lack the per-bidder cap. Ausubel (2004) shows that without a cap, a sufficiently large bidder maximizes expected payoff by submitting a step demand schedule that understates their true demand at high prices. The aggregate effect is suppression of the clearing price.

Google’s 2004 IPO is the case study. The auction range indicated $108–135; the actual clearing came in at $85 — 21–37% below the indicated band. Market participants attributed this to institutional bidders gaming the auction structure exactly as Ausubel predicted.

The per-bidder cap structurally fixes this. Once any bidder is large enough to face a binding allocation cap, withholding demand no longer suppresses price — it just leaves the bidder’s allocation unfilled. The optimal strategy collapses to truth-telling at the cap, which is the auction theorist’s ideal.

Why it matters —With $\bar\alpha = 20\%$ and $N = 10{,}000$, no single bidder can take more than 2,000 tokens. A whale with $2M of true demand at any price is structurally limited to a 2,000-token allocation. That single structural choice closes the demand-reduction loophole.

The reserve is published in advance, computed from the engine’s low-band V_HC:

The 80% coefficient and the use of the low-band (not mid) together imply a reserve well below the engine’s expected fair value. The mechanism is informed-principal in the Maskin–Tirole (1990) sense: the issuer signals confidence in the forecast by accepting a low reserve floor publicly. Bulow & Klemperer (1996) provide the related counsel: the gain from attracting one additional bidder dominates the gain from tightening reserve.

The reserve’s methodology is published before bidding opens. Bidders can verify the reserve is derived from the same inputs that produced the listing approval. This makes the reserve credible without requiring the issuer to be trusted.

When capped demand is between the minimum threshold $\underline n$ and the supply $N$, the auction clears partially. The supply schedule is invariant — Preflop never adjusts $N$ to match demand. Unsubscribed tokens go into a retained allocation pool:

• —Held by the issuer’s controlled vehicle (PEE for covenants)
• —Subject to the 18-month insider lockup post-unlock (see pre-IPO lock spec)
• —Releasable into secondary trading after lockup expires; not re-auctionable

The fixed-supply invariant is load-bearing for $e_{\text{eff}}$ arithmetic: every token class is exactly $N = 10{,}000$ tokens, so e_eff ratios are comparable across listings. Re-supplying on demand would break this.

The auction lives inside one of three regulatory exemptions depending on the listing’s posture:

Each path has different solicitation, disclosure, and ongoing- reporting requirements. The auction mechanism itself is path-neutral — the same clearing algorithm runs regardless. What changes is the bidder pool composition and the disclosure depth required upstream.

Settlement uses threshold encryption (Shutter-style) so bids are encrypted at submission and decrypted atomically at the clearing block. Pseudocode:

contract PreflopAuction {
  // Phase 2: bidders submit encrypted (p_i, q_i) sealed under threshold key
  function submitBid(bytes encryptedBid) external payable {
    require(state == Phase.Indication);
    require(msg.value >= maxBidValueLockup); // AON escrow
    bids.push(Bid({ bidder: msg.sender, ciphertext: encryptedBid, escrow: msg.value }));
  }

  // Phase 3: settlement — atomic decryption + clearing in one tx
  function settle(bytes thresholdSignature) external {
    require(state == Phase.Clearing);
    require(verifyThresholdSig(thresholdSignature, decryptionKey));

    Bid[] memory revealed = decryptAll(bids, decryptionKey);
    (uint Pstar, uint nStar, bool valid) = computeClearing(revealed, reserve, alphaCap, N, minClear);

    if (!valid) {
      // SEA Rule 15c2-4 AON: return all escrows
      refundAll(bids);
      state = Phase.Failed;
      return;
    }

    // Mint at P*, allocate per algorithm, refund excess escrow
    mintAndAllocate(revealed, Pstar, nStar);
    state = Phase.Settled;
  }
}

• —AON escrow per SEA Rule 15c2-4: all funds held in escrow until clearing succeeds; if invalid, refunded automatically
• —Atomic clearing block: settlement happens in a single transaction; no front-runner can race the mint
• —Threshold signature: requires $t$ of $n$ trusted decryptors to reveal bids; collusion among fewer than $t$ can’t expose the book

Narrative —The Maya numbers below use the math-foundation pedagogical trajectory (TEB(0)→TEB(10) = $20K → $600K, V_HC^mid = $3.01M, e_eff = 1.66%, κ = 1.20 at $60K target). The live engine v2.1.0 produces materially different numbers for cold-start Maya (V_HC ≈ $860K, κ ≈ 3.92, speculative); see forecast-engine §Maya. Math-foundation is used here because the auction walkthrough predates the cohort-prior re-anchoring. Reconciliation is queued alongside /spec/cohort-priors.

Maya’s pre-indication disclosure (covenant $(s_1=3\%, T=10, s_2=1\%)$, $V_{\text{HC}}^{\text{mid}} = \$3.01\text{M}$, $V_{\text{HC}}^{\text{low}} = \$1.38\text{M}$, $e_{\text{eff}} = 1.66\%$, conviction 62, CI ±54%):

Guarantees

• ✓The clearing price $P^*$ is reproducible from the bid book and the algorithm — anyone can verify.
• ✓The reserve is derivable from the engine’s low-band V_HC — no issuer discretion at the floor.
• ✓Allocation is algorithmic — no underwriter-style book-running discretion.
• ✓Front-running is cryptographically impossible — threshold encryption guarantees atomic reveal.
• ✓Demand-reduction is structurally defeated by the per-bidder cap.

Doesn’t guarantee

• —That the clearing price is “right.” It’s the price the market agreed to. The market can be wrong.
• —That every issuer clears. Listings can fail validity (under-reserve, under-threshold) — funds return per AON.
• —That secondary-market prices track $P^*$. After clearing, secondary trading is its own price discovery (see Stage 4 of pricing).
• —Protection against fraudulent issuer disclosure. The auction is a price-discovery mechanism, not a fraud filter — that’s upstream curation’s job.

Complete derivations — game-theoretic equilibrium analysis, equilibrium uniqueness, edge cases, and the Solidity reference implementation — live in PreFlop/wiki/The-Math-Theoretical-Foundation.md Part 4B.