Key Highlights
- Vitalik Buterin has proposed EIP-8288, a design based on recursive STARKs for Ethereum’s mempool.
- The proposal could reduce the gas required for quantum-safe signatures and privacy protocols.
- Buterin said some quantum-safe operations that could require around 10 million gas today could potentially fall to the low tens of thousands.
Ethereum co-founder Vitalik Buterin has outlined a proposal that could lower the cost of privacy protocols and quantum-resistant cryptography by moving some computational work away from Ethereum’s main execution process.
Buterin described the idea in a September 9 post on X, referring to EIP-8288, titled “A note on recursive STARK mempools.”
The proposal is not an activated Ethereum upgrade. Instead, it describes a possible change to how nodes handle signatures, proofs, and other computationally intensive dependencies before transactions are included in blocks.
Buterin said he hopes the proposal can be considered for I-star, which he described as the Ethereum fork following Hegotá.
Proposal moves heavy computation into the mempool
Under the proposed design, transactions could include what Buterin calls “dependency frames.” These frames would contain statements that need to be proven, such as whether a message was signed by a particular public key or whether certain data satisfies a cryptographic condition.
Rather than requiring every node to independently perform each underlying cryptographic computation, mempool nodes would aggregate the proofs, while the block would carry a recursive STARK proving the validity of the dependencies.
Buterin described a process in which nodes periodically collect transaction envelopes, remove expired transactions, generate a recursively aggregated STARK proving their dependencies, and broadcast a new envelope containing that proof.
The block builder would then generate a final STARK covering the transactions it intends to include.
The resulting block would contain a compact proof of the underlying computations rather than requiring every cryptographic operation to be performed directly during execution.
Onchain data could be reduced
Buterin estimates that the proposed system would require one STARK of roughly 100–300 kilobytes, along with about 96 bytes for each statement being proven.
The design is intended to reduce the amount of computation that Ethereum’s execution layer needs to perform for complex cryptographic operations.
Buterin described the concept as a continuation of his earlier “Proof Singularity” idea, arguing that the components needed to implement it now exist.
Quantum-safe signatures could become cheaper
One of the proposal’s main applications is post-quantum cryptography.
Buterin highlighted SPHINCS-style quantum-resistant signatures as an example. He said the signature itself could remain outside the blockchain’s main execution path while the network records a compact proof that the signature is valid.
“Ultra-cheap quantum-safe signatures (SPHINCS-). Much of the cost savings comes from the fact that the signature data (~3 kB) does not have to go onchain.”
Buterin said schemes such as Falcon and ML-DSA, along with other lattice-based, code-based, or potentially isogeny-based systems, could theoretically be wrapped inside STARK proofs.
The approach could allow Ethereum to support different cryptographic systems without implementing each algorithm directly at the protocol level.
Ethereum’s quantum-readiness plans add context
The proposal comes shortly after Ethereum’s protocol developers outlined a longer-term target for post-quantum readiness.
Earlier in September, Ethereum’s Protocol cluster set December 2029 as its target for post-quantum readiness while narrowing the scope of the Hegotá fork around features including FOCIL and Frame Transactions.
EIP-8288 is separate from that readiness target, but it addresses one of the technical challenges associated with supporting more computationally expensive cryptographic systems.
Buterin has also previously emphasized quantum safety, privacy, AI-assisted verification, and scaling as areas of focus for Ethereum’s development.
Privacy transactions could also become cheaper
The same architecture could potentially reduce the cost of privacy-preserving transactions.
Buterin estimated that highly optimized privacy transactions can currently require around 300,000 gas, while a quantum-safe implementation could reach roughly 10 million gas.
Under his proposed architecture, he believes those costs could potentially fall to the low tens of thousands of gas.
The figures are Buterin’s estimates and would depend on the cryptographic construction and implementation. EIP-8288 changes where the expensive computation is performed rather than eliminating the underlying computational requirements.
Privacy costs and private account abstraction
EIP-8288 also builds on Ethereum’s broader work to reduce the costs of privacy transactions.
In August, Ethereum proposed an upgrade that could allow privacy pools to pay transaction fees directly, reducing the need for intermediaries to cover gas costs. That proposal focuses on how privacy transactions pay fees, while EIP-8288 focuses on reducing the computational cost of proving cryptographic operations.
Buterin also outlined a potential use for private account abstraction, which could keep account-management logic and certain ownership information private while still allowing Ethereum to verify the resulting state.
For example, users could potentially change ownership across accounts, DeFi positions and privacy-related notes without publicly revealing which specific objects were affected.
The proposed design could therefore extend beyond signatures and transfers to private account-related operations.
Ethereum could support new cryptography without EVM changes
Another part of EIP-8288 is its potential effect on cryptographic flexibility.
Ethereum currently needs protocol-level support when developers want efficient native verification for new signature or proof systems.
Under Buterin’s proposal, developers could submit the relevant cryptographic computation through dependency frames and provide a STARK proof of its validity.
That could reduce the need for separate EVM changes when Ethereum needs to support additional cryptographic standards.
The approach could become more relevant if Ethereum needs to support multiple post-quantum standards rather than relying on a single cryptographic system.
RISC-V and Bandwidth remain key design considerations
The proposal also introduces a technical decision around the language used to describe the computations being proven. Buterin said RISC-V, a widely used open instruction-set architecture, is currently the leading candidate.
If adopted, RISC-V could provide a common framework for computations performed outside Ethereum’s execution layer and later verified through recursive STARK proofs. Buterin said the choice would require careful consideration.
Moving computation outside the execution layer would not eliminate all resource costs. Nodes would still need to exchange transaction envelopes and proofs.
Buterin’s design aims to keep bandwidth requirements bounded by having each node broadcast roughly one 100–300 KB STARK per time interval, alongside existing transaction data. He suggested 500 milliseconds as an example interval.
The architecture would therefore shift some resource requirements from execution toward proof generation, verification and network communication.
EIP-8288 still requires further review
EIP-8288 remains a proposal, not a confirmed Ethereum roadmap commitment. Before it could be implemented, developers would need to resolve questions around the dependency-frame design, instruction set, proof-generation requirements, node resource use and integration with Ethereum’s existing transaction-processing system.
The proposal would also require broader review from Ethereum developers and the wider ecosystem. For now, Buterin’s post presents EIP-8288 as a possible direction rather than a finalized upgrade.
If the design progresses, it could give Ethereum another way to handle computationally expensive cryptography as privacy and post-quantum requirements develop.
Also Read: 37 European Banks Plan MiCA-Compliant Euro Stablecoin on Ethereum
