> For the complete documentation index, see [llms.txt](https://docs.blinklabs.xyz/blink/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blinklabs.xyz/blink/get-started/searcher-trust.md).

# Searcher Trust & Flow Privacy

Who is allowed to see your pending transactions, what they receive, how we verify they behave, and the controls you have over your own flow.

Recovering MEV means showing a pending transaction to searchers before it lands. That is the one step in Blink's pipeline that requires trust, so it is the step we control most tightly. This page explains who is admitted to our searcher network, what they receive, how we verify they behave, and how you can restrict your own flow further.

{% hint style="info" %}
In short: a small, individually vetted, per-chain set of searchers sees transaction fields but never your signature on the auction chains; the most sensitive flow reaches only the trusted tier; every bundle is attributed to a named searcher and checked on-chain; and you can restrict or opt out per transaction or per account.
{% endhint %}

## A closed network

Blink does not run an open searcher marketplace and there is no self-serve searcher API key.

* **Individual admission.** Every searcher is reviewed and admitted by the team. Depending on the tier, admission requires a combination of in-person meetings, a signed agreement, a bond posted with Blink and revenue commitments.
* **Per chain.** Access is granted chain by chain. A searcher admitted on Ethereum has no access on Base, BSC, Arbitrum, Robinhood Chain or Arc unless separately admitted there.
* **Named credentials.** Each searcher connects with a unique credential. Every message they receive and every bundle they submit is tied to that identity, which is what makes the monitoring below possible.
* **Small by design.** The active roster is a few dozen searchers on Ethereum and fewer on every other chain, and it is pruned: a searcher that stops delivering value is removed rather than left holding a key.

## Trust tiers

Searchers are tiered by how well we know them and how long they have run on our flow. Tiers are per chain and are assigned by the team, never earned automatically by bidding volume.

| Tier            | Who                                                                                                                                    | What they receive                                                                                        |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| **Trusted**     | Searchers we have met in person and have a long track record with on our flow. Contracts and bonds are in place with a number of them. | All flow, including the sensitive categories below and flow from originators configured as trusted-only. |
| **Established** | Searchers who completed onboarding and have been active in good standing beyond the ramp-up period.                                    | Standard flow.                                                                                           |
| **Ramp-up**     | Recently admitted searchers.                                                                                                           | Standard flow, under closer review during the ramp-up period.                                            |

For flow that must not leave our systems, Blink also runs value recovery in a walled garden: external searchers' strategies execute inside Blink's own infrastructure, so a transaction is priced and backrun without ever being sent out to a searcher. The searcher sees the flow only within that environment and cannot take the information anywhere else (see [Controls available to originators](#controls-available-to-originators)).

## What a searcher actually sees

* **Transaction fields, not a signed transaction.** On Ethereum, BSC and Arbitrum the feed carries the decoded fields a searcher needs to price a backrun (sender, recipient, value, calldata, gas, nonce) and never the signature. Nobody can rebroadcast, replay or front-run your transaction from what the feed publishes. On Base and Robinhood Chain, where searchers submit the bundle to the sequencer themselves, the signed transaction is shared for that reason; the audience there is the vetted set described above and the same monitoring applies.
* **Bids never feed execution.** On Ethereum, a searcher bids against your transaction hash and Blink assembles the bundle from its own copy of your transaction. What the feed shows is never what goes to a builder.
* **Sensitive payloads reach the trusted tier only.** On Ethereum, a transaction whose payload carries a credential a third party could reuse, for example a signed RFQ quote, a smart-account user operation or an account delegation, is shown to trusted searchers only and withheld from everyone else. This is automatic and needs no configuration. On BSC, user-operation and authorization fields are obfuscated on the feed.
* **Copying the feed does not pay.** Searchers are contractually barred from taking our flow anywhere but our auction ([terms §2.3](/blink/ethereum/searchers/terms.md)), and the feed is built so that doing so is unprofitable and detectable: it carries synthetic transactions that cannot execute, and flow that exists only to make misuse attributable to the credential that did it (see [Monitoring](#how-we-verify-searchers-behave)).
* **Confidentiality is a condition of access.** Searchers agree not to log, store or redistribute flow beyond building a bundle for the immediate opportunity ([terms §2.6 and §4](/blink/ethereum/searchers/terms.md)). Blink treats originator flow as confidential business information and never combines transaction data across customers ([privacy notice](/blink/misc/privacy-policy.md)).

## Controls available to originators

* **Opt out.** `?nomevrecovery=true` on any request keeps that transaction off every searcher feed; it still bypasses the public mempool and goes privately to builders. Your account can also be set to opt out by default, so nothing is shown to searchers unless a request explicitly asks for MEV recovery. See [Custom Configuration](/blink/ethereum/custom-configuration.md).
* **Trusted tier only.** Your account can be set so that your flow is broadcast to trusted-tier searchers only.
* **Walled-garden execution.** Your flow can be handled without ever being sent to an external searcher. Value recovery runs inside Blink's infrastructure: searcher strategies execute in-house against your transactions, and the transaction data never leaves our systems, so it cannot be logged, copied or misappropriated. This is also how we serve oracle flow that must not be backrun at all.

Account-level settings are configured by the Blink team. Contact <contact@blinklabs.xyz>.

## How we verify searchers behave

* **Bundle validation.** Every bundle is validated and simulated before it reaches a builder. A searcher's transaction cannot modify yours, cannot mark it as droppable or revertible, and is placed only directly behind it.
* **Full attribution.** Every bid and bundle is stored against the searcher that submitted it. Every landed transaction is hydrated from the chain and attributed back to the searcher, builder and originator involved. Payments to originators are computed from this record, so it is audited continuously.
* **Sandwich and front-run detection** on landed transactions. A suspected sandwich of an originator's user alerts the team.
* **Copy detection.** We scan landed blocks for data from our flow reappearing in third-party transactions, and reconcile every hit against when we received the transaction and who we published it to.
* **Builder reconciliation.** For landed transactions we confirm with the builders whether the transaction reached them through any path other than ours.
* **Attribution audits on sequencer chains.** On Base, Arbitrum and Robinhood Chain every backrun landing behind our flow is matched against the attribution bundle searchers are required to submit, and priority-fee and kickback rules are checked.

### Consequences

Violations result in throttled or delayed flow, suspension, permanent removal and forfeiture of accrued payments ([terms §7](/blink/ethereum/searchers/terms.md)). Where a contract or bond is in place, a breach carries financial and legal consequences beyond loss of access.

{% hint style="success" %}
Every key on our network belongs to a known party with something to lose, every leak is attributable to a specific credential, and the most sensitive flow never leaves the trusted tier. That is what lets us put your transactions in front of searchers without putting your users at risk.
{% endhint %}