The Accountability Trap: Vitalik, Millie, and Auryn on Receipt-Free Voting

Participants: Vitalik Buterin, Millie (Trueo), and Auryn Macmillan

A secret ballot hides a vote, but its deeper function is to stop the vote from becoming proof.

That was the starting point for the conversation. Receipt-freeness sounds simple in theory: a voter should not be able to prove how they voted, even if they want to. In practice, the harder question is what counts as proof.

A receipt is evidence that can travel outside the system. It might prove how someone voted, show that they abstained, transfer control to someone else, or reveal enough surrounding information to make coercion practical.

Receipt-freeness tries to break that loop by preventing private inputs from becoming leverage in a side game.

For a deeper technical primer on vote masking, receipt-freeness, and secret ballots, see our earlier post: Vote Masking and the Problem of Receipt-Freeness.

Public proof changes incentives

Vitalik began with the basic problem in public voting.

A voter faces two incentive systems: one tied to the outcome of the vote, and another tied to how that specific voter voted.

The first incentive is usually weak for any individual voter. In a large system, one vote is unlikely to change the final outcome. But a bribe, threat, or reputational consequence is aimed directly at the individual voter, regardless of whether their vote changes the result.

That is why public votes can distort decision-making. They do not just reveal preferences; they also make voters easier to reward, pressure, or punish.

The harder goal is not only to hide the vote, but to remove the receipt.

Private voting and receipt-free voting solve different problems. A private vote means others cannot see how someone voted. A receipt-free vote means the voter cannot credibly prove how they voted.

“You can’t prove how you voted, even if you wanted to."

That second property is what matters for coercion resistance. If a voter can produce proof, someone else can condition payment, punishment, or social standing on that proof. If the voter cannot produce proof, the side game becomes harder to enforce.

That is the accountability trap. In many systems, accountability means making inputs visible. In receipt-free systems, the goal is different: make the outcome verifiable without exposing each participant individually.

The public result still needs to be trusted. But verification should come from the result, not from receipts produced by voters.

MACI and the coordinator problem

The conversation then moved to MACI: Minimal Anti-Collusion Infrastructure.

Vitalik described MACI as a general-purpose voting system designed to support mechanisms like quadratic voting, ranked-choice voting, and approval voting while preserving important privacy and anti-collusion properties. MACI uses encrypted messages and zero-knowledge proofs to let voters update or override prior votes while preserving verifiable correctness.

But MACI also has a coordinator.

The coordinator processes encrypted messages and publishes the final result. Correctness can be verified, but the coordinator remains an important trust assumption for privacy, liveness, and coercion resistance.

Auryn connected that directly to the origins of Interfold’s work. After running the MACI coordinator for clr.fund rounds, the trust assumption became concrete. He could trust himself to act honestly as coordinator. The harder question was why everyone else should have to.

“I trust that I’m honest, but I was always a bit skeptical that anyone else should trust that I was honest.”

That experience points to the broader design question: can the coordinator role be distributed?

Even an honest coordinator still occupies a privileged position in the system. For a system concerned with coercion resistance, that matters: the coordinator can affect who sees, orders, processes, or withholds the private messages that make the outcome possible.

Oracles and private signals

The same receipt problem appears anywhere a mechanism depends on private judgment.

Millie from Trueo extended the discussion beyond ballots and into prediction markets, oracle design, and systems built around private signals.

Prediction markets are often framed around externally observable outcomes: did an event happen, did a price move, did a team win? But many useful questions are subjective. What does a group believe? How does a selected population assess a situation? What signal emerges from many private judgments?

For oracle-like systems, that distinction matters. If a mechanism depends on private judgments, and participants can later prove what they submitted, the mechanism can be distorted by bribery, coercion, or coordinated side games.

Verifiable outcomes without exposed inputs

That is the broader category Interfold is built around: confidential coordination.

The Interfold lets companies, institutions, and communities compute together, even in competitive or adversarial settings: each party keeps its inputs private, while everyone can verify the result is correct.

Receipt-free voting makes the larger coordination problem visible: when private actions become externally provable, they can be bought, pressured, or punished.

The goal is not to choose between secrecy and trust. It is to build systems where outcomes can be verified without exposing the people and inputs underneath them.