Vitalik Buterin Drafts Ethereum (ETH) EIP-8288 to Cut Signature Costs by 99%

One STARK Proof for Every Signature

Ethereum (ETH) co-founder Vitalik Buterin has put forward EIP-8288, an improvement proposal that folds the verification of many cryptographic signatures into a single STARK proof, introduced in a post on X. Nothing in the draft moves the Ethereum price directly; its force is on protocol costs. The heaviest of those sits in signature checking: under the current rules, verifying a quantum-resistant signature can consume roughly 10 million gas, and Buterin's estimate places the same check in the tens of thousands of gas once EIP-8288 is live, a cut of more than 99% against today's gas fee baseline. The mechanism runs in two steps. A user first selects the signature scheme they want and generates an individual proof for it. Mempool nodes then handle the declared dependencies in bulk and produce one compressed STARK proof for the whole batch, so the block producer, the validator assembling the block, verifies only the aggregated result instead of each signature in turn. The design also lifts a structural constraint. Today, supporting a new cryptographic algorithm efficiently means adding a dedicated precompile, a hand-maintained built-in function inside the smart contract layer. EIP-8288 instead lets the network accept a range of signature schemes without embedding each algorithm directly, which leaves developers free to pick their own verification method. The proposal sits at the very start of the pipeline, a draft specification rather than merged code, and no client team has shipped an implementation to a devnet or testnet yet. Buterin framed it as groundwork for a verification layer the protocol can extend over time, not as a patch for one algorithm. The same STARK proof class already secures much of the Layer 2 scaling stack, giving the approach production precedent outside the base chain.

Quantum Threat and the I-star Timeline

The motivation traces to a specific exposure. Ethereum's elliptic curve digital signature algorithm, ECDSA, holds against classical computers but would be broken once a quantum machine of sufficient scale exists, and the candidate replacements cost more by design: their signatures carry larger data payloads and burn more gas to verify, which is why quantum-resistant adoption has stalled. EIP-8288 attacks that barrier by aggregating verification work instead of accelerating any single scheme. The draft also connects to account abstraction, the framework that lets each account set its own authentication method. Combined with the frame transaction structure defined in EIP-8141, Buterin expects users to move past the single private-key model and run varied security schemes on the same chain, a flexibility that the chain's upgrade history has been building toward for years. On timing, the draft is expected to be taken up with the I-star upgrade, the upgrade that follows the Hegota hard fork, though the specification sets no activation date and no block number, and readers tracking fork timing can follow our guide to never miss a hard fork. Implementation carries open questions the draft itself acknowledges: generating the aggregated proof consumes real resources, and the network has not demonstrated how mempool dependency processing behaves at scale. Under the current precompile route, each new algorithm adds maintenance weight for client teams; the aggregated route shifts that weight to proof generation. Starknet co-founder Eli Ben-Sasson has separately urged caution on the maturity of lattice-based cryptography and the possibility of AI-assisted attacks against new schemes. What draws attention to EIP-8288 is therefore less any one quantum-safe algorithm than the structure it describes: a protocol layer able to absorb new cryptographic technology without a hard-coded replacement cycle. That structural read is also why the proposal has drawn interest across Ethereum protocol development circles despite its early status.

Proof Costs and Stability Checks Remain

Our reading: EIP-8288 is infrastructure for a transition the protocol will eventually need, and the honest status is early. The draft changes no live parameter, reprices no opcode, and carries no activation block; its next concrete gate is a reference implementation that can demonstrate proof-generation cost and network stability under load, ahead of any slot in the I-star discussion that follows Hegota. For node operators the near-term impact is nil until that work lands. Anyone weighing the 99% figure against the Ethereum technical analysis picture should treat this as a development-cycle story: the cost estimate is the author's own, not a measured benchmark, and it stays untested until a client actually runs it.