Co-founder of Ethereum Vitalik Buterin explained the concept of EIP-8288 — a proposal aimed at adding recursive aggregation of STARK proofs and cryptographic signatures at the mempool level to the network. Buterin hopes to include this approach in the I-star upgrade, scheduled to follow Hegota, as it could significantly reduce costs for post-quantum signatures, private transactions, and new cryptographic schemes without requiring changes to the EVM.
EIP-8288, authored by Vitalik Buterin and Thomas Coratje, was created on June 3, 2026. The proposal extends EIP-8141 with a new frame type that allows cryptographic signatures and STARK proofs to be aggregated off-chain and then verified with a single recursive STARK, without needing to store all the original data directly in the block. EIP-8141 and the recursive STARK mempool became part of research into transitioning from sequential execution to separating transactions into actions and dependencies.
The core of the mechanism will be dependency frames — parts of a transaction containing assertions about its dependencies. For example, a frame can confirm that a specific message hash is signed by a particular public key, or that certain data satisfies a condition defined by a verification key. When a transaction enters the mempool, nodes aggregate the received dependencies. Every approximate 500 ms, a node collects new transactions, removes expired ones, generates a recursive STARK confirming all dependencies, and forwards a new envelope for multiple transactions. Each node's outgoing traffic will consist of one STARK of approximately 100–300 KB per cycle, plus a standard one-time transmission of the transactions themselves. The block builder will then function as another mempool node: it will receive transactions, generate its own STARK for the portion of dependencies it plans to include in the block, and attach the proof to the block. As a result, the total amount of data that needs to be stored on-chain will be one STARK of 100–300 KB plus 96 bytes per assertion it verifies. Buterin called this concept Proof Singularity.
One of the key advantages of EIP-8288, according to Buterin, is the reduction in cost of post-quantum cryptography. Currently, hashed post-quantum signatures can take up around 2–3 KB and require approximately 150,000–200,000 gas for verification, whereas the proposed approach would eliminate the need to store the actual signature data on-chain. This could make post-quantum signatures such as SPHINCS+ "ultra-cheap." A similar principle is proposed for private protocols: at present, a well-optimized private transaction costs around 300,000 gas, while post-quantum solutions may require around 10 million gas. According to Buterin's estimates, EIP-8288 could potentially reduce this figure to tens of thousands of gas.
Another advantage is the ability to use new cryptographic schemes without changes to the EVM. In particular, Falcon, ML-DSA, and other algorithms are mentioned, as well as lattice-, code-, and isogeny-based schemes: these can be wrapped in a client-side STARK, while on-chain costs remain at the level of tens of thousands of gas. The developer also highlighted private account abstraction: this approach would allow concealing account logic and transferring ownership of the entire on-chain state — accounts, DeFi positions, and private protocol records — in a single transaction, without revealing which specific objects changed hands.