Ethereum co-founder Vitalik Buterin on Sept. 9 explained EIP-8288, a proposal to introduce recursive aggregation of STARK proofs and cryptographic signatures at the mempool level. He said the approach could make post-quantum signatures, private transactions and new cryptographic schemes significantly cheaper without requiring changes to the Ethereum Virtual Machine.

Buterin hopes the proposal can be included in the I-star upgrade, which is expected after Hegota. He described it as the next step after Frames in a note on recursive STARK mempools.

How the recursive STARK mempool would work

EIP-8288, authored by Buterin and Tomas Koratje, was created on June 3, 2026. It extends EIP-8141 with a new frame type that would allow cryptographic signatures and STARK proofs to be aggregated offchain and verified through a single recursive STARK, without storing all the original data directly in a block.

EIP-8141 and the recursive STARK mempool are part of research into moving away from sequential execution by splitting transactions into actions and dependencies. The proposed mechanism would use dependency frames, which contain claims about a transaction’s dependencies. A frame could, for example, attest that a particular message hash was signed by a specified public key or that certain data met a condition defined by a verification key.

When transactions enter the mempool, network nodes would aggregate their dependencies. Every notional 500 milliseconds, a node would collect new transactions, remove expired ones, generate a recursive STARK attesting to all dependencies and forward a new envelope covering multiple transactions.

Buterin said this design could limit bandwidth demands. Each node’s outbound traffic would consist of one STARK of about 100-300 KB per cycle, in addition to the usual one-time broadcast of the transactions across the network.

A block builder would effectively operate as another mempool node. It would receive transactions, generate its own STARK for the dependencies it planned to include and attach the proof to the block. The blockchain would then store one STARK of 100-300 KB plus 96 bytes for each claim covered by the proof.

Buterin called the concept “Proof Singularity” and said it could already be implemented with existing technology.

Post-quantum signatures and privacy

Buterin said a key benefit of EIP-8288 would be lower costs for post-quantum cryptography. Hashed post-quantum signatures can currently be about 2-3 KB and require roughly 150,000-200,000 gas to verify, while the proposed model would avoid placing the signature data itself onchain.

He said the approach could make post-quantum signatures such as SPHINCS- “ultra-cheap.” Buterin also proposed applying the same principle to privacy protocols. A well-optimized private transaction currently costs about 300,000 gas, while post-quantum solutions may require around 10 million gas. He estimated that EIP-8288 could reduce that cost to a few tens of thousands of gas.

The proposal could also allow developers to use new cryptographic schemes without modifying the EVM. Buterin cited Falcon, ML-DSA and other lattice-, code- and isogeny-based algorithms and schemes, which could be wrapped in a client-side STARK while keeping onchain costs at a few tens of thousands of gas.

“Hopefully, Ethereum will never need “please support my favorite cryptographic algo” politics again,” Buterin wrote.

Buterin separately highlighted private account abstraction. He said it could conceal account logic and allow ownership of an entire onchain state — including accounts, decentralized-finance positions and private-protocol records — to be transferred in one transaction without revealing which specific objects changed hands.

Implementation requirements

Under EIP-8288, computations and data outside the core business logic of transaction execution would move off Ethereum’s main execution path. Mempool nodes would process and parallelize those operations, while the blockchain would retain a compact proof of their correctness.

Developers would also change how they handle signatures and STARKs. Instead of directly verifying a cryptographic proof, the core transaction logic would check for a frame containing the relevant claim as a dependency.

Implementation would require Ethereum to select a language, or instruction-set architecture, for recursive STARKs. Buterin identified RISC-V as the leading candidate but said the decision required careful consideration because it could establish RISC-V, or another ISA, as Ethereum’s canonical standard.

EIP-8288 also provides for compatibility with FOCIL and uses Lean Ethereum tools for signatures and STARKs.

Source: Incrypted