EIP-1108 alt_bn128 precompile gas cost reduction (Reduce alt_bn128 precompile gas costs)
Final · Fees & gas · EIP status Final · created 2018-05-21
Significantly lowers the gas cost of the elliptic curve operation precompiles (ECADD, ECMUL, pairing check) to match their actual computational speed. ECADD drops from 500 to 150, and ECMUL drops from 40,000 to 6,000.
Why it is needed
Ethereum has special built-in contracts called precompiles that implement frequently used cryptographic operations. Among them, the three alt_bn128 elliptic curve operations (addition, multiplication, and pairing check) are core building blocks for privacy- and scalability-oriented technologies such as zero-knowledge proofs. However, in 2018 Geth switched to Cloudflare's bn256 library, which cut the actual computation cost of these operations to roughly a tenth of what it had been, and the Parity client also became significantly faster through bn library optimizations. Gas costs are supposed to reflect the burden an operation places on the network, but the fee schedule still reflected the slower era, making it far more expensive than it should have been. As a result, protocols such as AZTEC, ZEther, and rollups were constrained in how much they could use on mainnet because of gas costs. This EIP fixes the bottleneck by updating the fee schedule to match reality.
What changes
Today
- ECADD costs 500 and ECMUL costs 40,000 gas
- A pairing check costs 80,000 x k + 100,000 gas (k is the number of pairings)
- Verifying the cryptography for a single AZTEC confidential transaction costs 820,000 gas
- A ZEther transaction costs about 6,000,000 gas
After EIP-1108
- ECADD drops to 150 and ECMUL drops to 6,000 gas
- A pairing check drops to 34,000 x k + 45,000 gas
- The same AZTEC verification drops to 197,000 gas
- A ZEther transaction drops to about 1,000,000 gas
Who is affected
- Zero-knowledge-proof application developers: The cost of verifying zk-SNARKs drops substantially, making features such as confidential tokens, confidential voting, and anonymous identity proofs practical to deploy on mainnet.
- L2 and rollup projects: As proof verification gets cheaper, more rollup-style transactions can be processed per block, and batching multiple proofs together for verification also becomes easier.
- Client teams: Both Geth and Parity already have the fast libraries built in, so only the gas fee schedule needs to change, with no new cryptographic code required.
- Users: Lower fees for privacy-preserving transactions and L2 usage expand the range of options available.
In depth
Details of the gas cost changes
ECADD at address 0x06 drops from 500 to 150, and ECMUL at address 0x07 drops from 40,000 to 6,000. The pairing check at address 0x08 drops from 80,000 * k + 100,000 to 34,000 * k + 45,000 (k is the number of pairings). The prior values for ECADD and ECMUL were defined in EIP-196, and the prior value for the pairing check was defined in EIP-197. The new gas costs were adjusted to match the benchmarks of Parity, the slower-performing of the two clients.
Method for setting gas costs: using ecrecover as the baseline
By measuring that a single execution of the ecrecover precompile takes 116 microseconds and assuming its gas cost of 3,000 is fair, a unit cost of 25.86 gas per microsecond was derived. The pairing precompile took 3,037 microseconds for 1 computation and 14,663 microseconds for 10 computations, from which a linear structure of a fixed cost of 1,745 microseconds plus 1,292 microseconds per pairing was extracted, since the algorithm's structure allows splitting it into a fixed cost and a per-pairing cost. Applying this unit cost yields a formula of roughly 35,000 * k + 45,000, which was reflected in the final fee schedule as 34,000 * k + 45,000.
Background on the speed improvement
When the official Go reference implementation (go-ethereum) replaced its underlying library for ECADD, ECMUL, and pairing checks with Cloudflare's bn256 library, the computation cost dropped by roughly an order of magnitude (10x) across the board, excluding constant terms. The bn crate used by the Parity client also saw major performance gains from 2018 and 2019 optimizations, and the authors benchmarked it themselves and compared it against prior results. In other words, this EIP does not introduce a new algorithm, it simply reflects the already-faster client performance in the fee schedule.
Protocols that benefit
The AZTEC protocol uses this precompile to build confidential tokens with zero-knowledge transaction logic. It also plans confidential weighted voting, partial fills of encrypted orders (private DEX), anonymous whitelist proofs, and confidential payment channels between mainnet and L2, though gas cost is currently the limit on practicality. Matter Labs is building a scaling solution called Ignis with a throughput of 500 transactions per second, and the Rollup project uses this precompile to implement an L2 whose validity is guaranteed by mainnet without a separate consensus layer. ZEther builds confidential transactions using ECADD and ECMUL. For zk-SNARK based protocols, beyond lowering verification cost, this also enables batching multiple proofs together for verification and makes it easier to split large circuits into several smaller ones.
The effect of trading storage for computation
Solutions like Rollup or Ignis compress a batch of individual transactions into a single zk-SNARK proof and represent on-chain state as a single small Merkle root instead of many account balances. As zk-SNARK verification cost falls, such solutions can be deployed for a wider range of uses, and the number of rollup-style transactions processable per block increases. This widens the path for replacing expensive on-chain storage with cheaper computation.
Deployment readiness and the relationship to EIP-1829
Both Parity and Geth already ship cryptography libraries fast enough to justify the lowered gas costs, so no new library deployment is needed. Reference implementations include the Parity bn crate (Rust), the Geth bn256 library (Golang), MCL (C++), and Libff (C++), all of which match or exceed the Parity benchmark. This EIP was proposed for the Istanbul fork to complement EIP-1829, which addresses general-purpose elliptic curve operations, by providing an immediate fix for the expensive cryptography problem while a more advanced solution is being developed. Since the underlying algorithm itself is unchanged, no additional test cases are specified. This EIP's status is finalized as Final.