By Vitalik Buterin has proposed bringing recursive STARK-based mempools to Ethereum through EIP-8288, describing the technology as a potential next step after Frame Transactions that could make advanced cryptography dramatically cheaper. Buterin said September 9 that he hopes EIP-8288 will be included in I*, the Ethereum network upgrade planned after Hegotá. The proposal is not yet confirmed for I* and remains a draft.
Its central idea is to stop requiring every transaction to place large cryptographic signatures or proofs directly onchain. Instead, transactions could declare signatures and STARK proofs as dependencies. Ethereum’s mempool infrastructure would verify and recursively aggregate those dependencies before a block builder includes a compact proof representing many transactions.
Quantum-Safe Transactions Could Become Far Cheaper
The potential cost reduction is substantial. Buterin estimates an efficiently engineered private transaction currently requires around 300,000 gas, while a quantum-safe equivalent could cost roughly 10 million gas using existing approaches. Recursive aggregation could potentially reduce the latter to the low tens of thousands of gas. Post-quantum signatures illustrate why. Some quantum-resistant schemes produce signatures several kilobytes in size. Buterin cited SPHINCS-based signatures of roughly 3 KB, making direct inclusion on Ethereum expensive.
EIP-8288 would allow much of that data to remain offchain. Mempool nodes would periodically combine proofs into recursive STARKs and forward the aggregate proof alongside transactions stripped of their individual proofs. Buterin’s earlier research proposed producing one recursive STARK roughly every 500 milliseconds. Even if individual STARKs are around 128 KB, the bandwidth overhead per node remains relatively constant instead of increasing proportionally with every proof entering the mempool. The approach could also support new signature systems without repeatedly modifying the Ethereum Virtual Machine. A wallet using Falcon, ML-DSA or another future cryptographic scheme could potentially wrap its verification logic inside a STARK and use the same aggregation infrastructure.
EIP-8288 Builds on Ethereum Frames
EIP-8288 is designed as an extension of EIP-8141, or Frame Transactions. Frames separate transaction authorization, fee payment and execution, giving Ethereum more native account-abstraction capabilities. Ethereum developers have scheduled Frames for consideration in Hegotá. Buterin characterizes recursive STARK mempools as the next step: Frames provide flexible transaction structure, while EIP-8288 would make sophisticated cryptographic dependencies economical. The Ethereum Foundation’s latest protocol roadmap places post-quantum security among five multi-fork research priorities alongside fast finality, privacy, state management and zkEVM development. I* is already expected to carry substantial protocol work.
The Foundation says decoupled consensus is currently the leading headline candidate for I*, while major state migration work is also expected to begin during that fork. That makes inclusion of EIP-8288 far from guaranteed. The proposal also creates engineering challenges around recursive-proof generation, mempool networking and ensuring builders cannot improperly omit dependencies. Still, its implications extend beyond quantum resistance. The same architecture could make privacy proofs cheaper and allow Layer 2 systems or future applications to introduce new proof schemes without requiring Ethereum to add dedicated verification logic for each one. Buterin first outlined the underlying recursive-STARK mempool concept in January.
EIP-8288 now turns that research into a concrete protocol proposal tied to Ethereum’s longer-term upgrade path. If eventually adopted, Ethereum would effectively move expensive cryptographic verification away from individual transactions and amortize it across many users. That could make post-quantum security and advanced privacy features practical without forcing users to absorb the enormous gas costs those technologies would require under Ethereum’s current transaction model.