Hook
Ten million gas. That is the number attached to a single quantum-safe private transaction on Ethereum today — roughly $900 at 30 gwei and a $3,000 ETH, or several blocks' worth of average execution demand for one transfer. On September 9, Vitalik Buterin published EIP-8288, a proposal to recursively aggregate STARK proofs inside the mempool and move signature verification out of Ethereum's core execution path. The claimed outcome: that ten-million figure collapses to "tens of thousands of gas."
In 2017 I spent 180 hours tracing execution paths through Michelson delegation contracts, looking for unauthorized fund diversion. That habit does not retire. The gas number moves. The cost does not disappear. The only question worth asking is where it lands, and who pays for it.
Context
Post-quantum signature schemes are heavy by construction, not by oversight. Falcon signatures run 666 bytes. ML-DSA, standardized as FIPS 204, produces signatures between 2,420 and 4,627 bytes, with public keys between 1,312 and 2,592 bytes. Ethereum's ECDSA signature is 65 bytes, and the ecrecover precompile is priced accordingly. Lattice-based verification inside the EVM is not a parameter tweak; it is a different cost class entirely.
That arithmetic is why quantum-safe signatures have existed on paper for years without existing on-chain at scale. Every prior path required a hard fork — a new precompile, a new transaction type, a rewritten gas schedule. EIP-8288 takes a different route. Nodes periodically aggregate transaction dependencies in the mempool. Block builders generate recursive STARKs proving the aggregate. Signature verification leaves the execution path. Tracing the ghost in the ledger, byte by byte, means following that verification to wherever it resurfaces.
The proposal specifies compatibility with Falcon and ML-DSA, no EVM modification, support for private account abstraction, a per-block cost of 100 to 300 KB of STARK data plus 96 bytes per proven statement, and a target slot in the I-star upgrade following Hegota. It also implies something larger: if recursive STARK aggregation becomes standard, RISC-V likely becomes the standard instruction set beneath it.
Core
EIP-8288 does not eliminate verification cost. It relocates it to data availability, and the relocation is quantifiable.
Run the low case. A modest block aggregates 2,000 statements: 192 KB of statement data at 96 bytes each, plus a 100 KB proof. That is 292 KB of overhead on top of ordinary transaction payloads. Ethereum's EIP-4844 blob target sits at 384 KB per block, with a 768 KB ceiling. The low case consumes 76% of the target. Run the high case — a 300 KB proof against the same statement count — and you arrive at 492 KB, which exceeds the target budget by 28% before a single rollup posts its batch.
Blob space is the scarcest resource in a post-Danksharding Ethereum. It is metered by a separate fee market. If recursive proof aggregation consumes three-quarters of the target blob budget, the marginal cost does not vanish; it migrates into the blob base fee, and every rollup competes for what remains. The proposal's economics are stated in execution gas, but the binding constraint after implementation is data availability. This is where the DA-skepticism argument inverts: for most rollups, dedicated DA is overbuilt and barely used. Here, DA is genuinely scarce and about to be consumed by proofs that no user requested at launch.
The second problem is verification. The design has block builders generating proofs. If validators accept blocks without re-executing the recursive verifier, verification is outsourced to a professionalized builder set — a cartel, functionally, however permissionless the entry. This is the same structural condition that made FTX's internal ledger tolerable to counterparties: everyone assumed someone else was checking. In 2025, comparing declared versus audited stablecoin reserves across twenty Berlin issuers, I found the identical failure mode — 60% of them disclosed figures no independent party had reconciled. Centralized accounting and unverified proofs fail the same way. Quietly, then all at once. The chain never lies, only the observers do.
The third problem is maturity. The proposal is at concept stage and unaudited. It depends on RISC-V as the recursive STARK instruction set — a standard not yet adopted by the network. It depends on Falcon and ML-DSA implementations that currently exist as NIST specifications and reference code, not as battle-tested on-chain verifiers. Post-quantum signatures verify correctly or they do not. There is no partial credit and no downgrade path.
| Metric | Proposal's claim | Reading | |---|---|---| | Execution gas | 10,000,000 → tens of thousands | Plausible, execution layer only | | Block proof overhead | 100–300 KB | 26–78% of the 384 KB blob target | | Per-statement overhead | 96 bytes | 192 KB at 2,000 statements | | EVM modification | None required | Verifiable claim, no verifier path specified | | Audit status | EIP draft / concept | No external audit |
Flaws hide in the decimal places.
Contrarian
Now the part the bulls got right, and it deserves stating without qualification. The signature cost problem is real, and nobody has solved it without a fork. EIP-8288's most defensible property is not the gas reduction — it is the claim of zero EVM modification. Every prior post-quantum proposal required a precompile or a new transaction type, which means a hard fork, which means coordination risk on a network that measures consensus cycles in years. A mempool-level aggregation layer that preserves existing execution semantics is the cheapest credible path anyone has put forward.
The architectural instinct is also correct. Rollups moved execution off L1 and created a fee market for data. EIP-8288 moves verification into the mempool and creates a fee market for proofs. That is consistent evolution, not novelty for its own sake. Vitalik's personal weight behind the proposal is a real accelerant, and the EIP process is the right venue.
The blind spot is that nobody has priced the second market. Every exit is an entry point for the truth, and the exit here is the execution layer — the entry is the blob auction. If a single aggregated STARK batch consumes three-quarters of the target blob budget per block, the rollout story is not "quantum-safe transactions become cheap." It is "quantum-safe transactions become cheap for whoever wins the blob auction." That is a different distributional outcome than the headline implies, and the proposal does not model it.
Takeaway
The measurable question is not whether EIP-8288 works. It is what percentage of blob capacity recursive STARK aggregation consumes at steady state, and whether an independent verifier sits anywhere in a validator's default path. Both are observable. Watch the EIP repository rather than the announcement, and watch the blob base fee rather than the gas estimate. History is written in blocks, not headlines — and the first mainnet block carrying a 300 KB proof will tell you more than the proposal that proposed it.
