Quantum-resistant signatures that today cost hundreds of thousands of gas to verify on Ethereum would settle in the low tens of thousands under EIP-8288 STARK aggregation, a reduction of more than 99%, and every future cryptographic scheme could become deployable on the network without a new EIP or hard fork. Ethereum co-founder Vitalik Buterin made that case publicly on October 19, 2026, calling for “EIP-8288 maximalism” in a post on X. He argued that the protocol should stop embedding new cryptographic primitives directly into execution clients and instead route all signature and proof verification through a single STARK-based aggregation layer.
The precompile problem
Precompiles are hard-coded functions embedded in every execution client, including Geth, Nethermind, Besu, and Erigon, that let smart contracts perform expensive cryptographic operations at sustainable gas costs. Each one is a permanent commitment, because adding a precompile requires a hard fork in which every client team implements the same logic, creating a consensus-critical surface where a single divergent implementation can cause a chain split. In September 2016, denial-of-service attacks against precompiles forced two emergency hard forks to reprice them. Precompiles have also proven structurally incompatible with ZK-EVM proof systems, where the operations are expensive and brittle to encode in standard constraint systems.
Buterin has acknowledged this dynamic before. His 2024 draft EIP-7666 proposed “EVM-ifying” the identity precompile as a first step toward trimming the list, and a more recent draft, EIP-8200, extended the same approach to five rarely used precompiles, including RIPEMD-160, MODEXP, and several BLS12 map-to-curve functions. The post-quantum transition, which requires replacing at least four core cryptographic systems, threatened to make the problem substantially worse, according to the Ethereum post-quantum security roadmap that prompted the new push.
How EIP-8288 STARK aggregation would work
The EIP, co-authored by Buterin and Ethereum Foundation post-quantum researcher Thomas Coratger, is titled “In-mempool signature and proof aggregation.” Instead of submitting a raw signature or proof, a user generates a STARK proof locally attesting that their chosen cryptographic operation is valid and submits that proof to the mempool. Mempool nodes running aggregation software collect the incoming proofs and fold them together recursively every second or so, passing a single composite STARK proof downstream. By the time a block is assembled, all cryptographic verification for every transaction in that block is captured in one recursive proof, which validators check at a fraction of the cost of checking each operation individually.
Because the underlying cryptographic data never hits the chain as calldata, Ethereum’s protocol layer never needs to know which signature scheme a given user chose. A wallet running secp256k1, a hash-based leanSPHINCS post-quantum key, or a lattice-based scheme introduced years from now can all funnel through the same aggregation pipeline unchanged. Buterin’s maximalist line was direct: “Ethereum does not need to add new precompiles,” a position that, if adopted, would let any team capable of writing a STARK circuit deploy new signature schemes on Ethereum without navigating the formal improvement process at all.
Gas math and the lattice debate
The cost reduction is the proposal’s most concrete claim. Quantum-resistant hash-based signatures verified directly on-chain today carry hundreds of thousands of gas, and raw STARK proofs are more expensive still, with proof sizes ranging from 128 kilobytes to 512 kilobytes and on-chain verification costs in the millions of gas. Under EIP-8288, Buterin estimated both would settle in the low tens of thousands, driven down by recursive aggregation distributing verification cost across every transaction in the block simultaneously. For context, a standard Ethereum transaction costs roughly 21,000 gas, so a quantum-safe transaction would approach that baseline from above rather than exceeding it by an order of magnitude.
The October 19 post did not arrive in isolation. It emerged from a months-long hash versus lattice cryptography debate within Ethereum’s research community that drew in venture firm a16z, analyst Gabriel Shapiro, and StarkWare CEO Eli Ben-Sasson. Lattice-based schemes such as ML-DSA, standardized by NIST in 2024, are widely viewed as the leading general-purpose post-quantum candidates, but Buterin has argued that lattice cryptography may be vulnerable to AI-assisted lattice attacks and has positioned hash-based approaches as the safer near-term choice. Ben-Sasson countered that lattice methods are not yet mature enough to secure large assets regardless of AI concerns, and StarkWare holds a direct commercial interest in STARK proving infrastructure becoming Ethereum’s standard verification layer. Shapiro warned that rival layer-one networks could exploit a conservative Ethereum stance to gain a “narrative advantage” by moving faster to adopt the NIST standard.
EIP-8288 faces a specific friction point: it contradicts the Ethereum Foundation’s own published planning. The Strawmap, the Foundation’s multi-fork roadmap targeting full post-quantum protection by 2029, retains “PQ sig precompiles” as a scheduled deliverable for the J fork, the very upgrade Buterin wants to use as the launching point for EIP-8288 instead. Under the current structure, Fork I would register post-quantum public keys for validators and Fork J*, if the annual hard fork cadence holds, would arrive around December 2029 to add precompiled verification for post-quantum signatures, precisely the pattern the proposal argues against. The specification also marks the leanSTARK aggregation route as “reserved” and depends on the Frames mempool mechanism in EIP-8141, which remains unscheduled, while Hegota, the next planned Ethereum hard fork, is targeting H2 2026 with timing still uncertain as of publication. EIP-8288 itself remains a draft, not an adopted standard, and the governance implication may ultimately matter more than the gas savings, because the EIP-8288 STARK aggregation path would let the protocol absorb new cryptography without another contentious hard fork.
Source: https://www.techtimes.com/articles/329238/20261020/ethereum-precompile-replacement-plan-eip-8288-would-cut-quantum-safe-transaction-costs-99.htm