I made a visualization of EIP-8288 aka "recursive mempool aggregation," my new favorite EIP of all time because it perfectly encapsulates the thesis of the "cryptographic world computer" -- a system whose scalability *increases*, not decreases, with the level of decentralization.
In a previous tweet I explained how EIP-8288 achieved this seemingly impossible feat, but one gif is worth a thousand words.
Essentially, EIP-8288 leverages Ethereum's decentralized mempool as a parallel ZK proving cluster. Clients send signatures and proofs to the mempool, which over multiple rounds progressively aggregate them into fewer and fewer proofs, until the block builder finally aggregates them into one SINGLE proof.
This design accomplishes five things at once:
- The more nodes we add to the decentralized mempool, the more signatures/proofs Ethereum can process as a whole. This is obvious if you look at the animation and imagine more nodes in the mempool ring, which would "fan out" to more signatures/proofs.
- By aggregating over multiple rounds (aka "recursive aggregation"), the bandwidth consumed by proofs remains constant for each node even as the network processes more proofs. As a result, the network stays decentralized even as capacity increases.
- By aggregating proofs before one final aggregation by the builder, as opposed to requiring the builder to aggregate everything, the network can process more proofs without increasing hardware requirements for the builder.
- By aggregating everything to a single block-level proof, validators can verify thousands of signatures/proofs by checking just one aggregated proof. Hardware requirements for validators can therefore stay low, keeping the network decentralized.
- By aggregating not just native signatures but also STARKs, Ethereum can support any signature scheme by wrapping them in STARKs.
So once again, this is how Ethereum will:
- scale to process tens of thousands of PQ and private transactions per second
- charge a tiny amount of gas to validate each txn, even though the original signature/proof may be huge (up to hundreds of KBs in size)
- all while decentralizing even MORE.
You are not bullish enough.
Ultimately, precompiles and EVM are both the wrong place to put most cryptography support into Ethereum. The reason is that precompiles and EVM both operate on data that has to be included into the ethereum chain somehow, which realistically means included in a block as calldata. That space is limited - even with PeerDAS and blocks-in-blobs, there's a practical cap of ~8 MB/s before it starts getting uncomfortable.
Remember: it's not a blockchain. It's a cryptographic world computer. Any data/computation that does not need to be in the "main thread" of data/execution should not be put into the main thread.
Instead, the correct solution is... EIP-8288 maximalism.
If you have any heavy computation that's self-contained, compute it and STARK it client-side (this is quickly getting faster and faster, even on phones), and push the STARK through the EIP-8288 recursive aggregation mechanism. The chain sees the fact that the computation was done and what the result is; it never needs to see the actual data and computation.
This way everyone can use whatever cryptography they want, the Ethereum chain can be lean, and we never need to add more precompiles again.