# Ethereum Researchers Ask the Network to Pick an Instruction Set for Post-Quantum Proofs Under EIP-8288

The proposal moves verification of quantum-resistant signatures and STARK proofs out of the virtual machine and into a single recursive proof per block. The instruction set Ethereum chooses will determine how fast phones and laptops can generate those proofs.

- Published: 2026-10-09T05:49:33.680Z
- Canonical: https://polylog.news/crypto/2026-10-09/ethereum-researchers-ask-the-network-to-pick-an-instruction
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Ethereum Research](https://ethresear.ch/t/exposing-an-isa-for-post-quantum-proofs-on-ethereum/26136), [Ethereum Research](https://ethresear.ch/t/the-unleashed-power-of-stacking-eez-fcr-seen-through-an-example/26133), [Ethereum Research](https://ethresear.ch/t/price-of-censorship-resistance-in-multiple-proposer-protocols-under-sybils/26131), [Ethereum Improvement Proposals](https://eips.ethereum.org/EIPS/eip-8288), [Crypto Briefing](https://cryptobriefing.com/eip-8288-recursive-stark-mempools-ethereum/), [Decrypt](https://decrypt.co/377857/vitalik-buterin-pushes-ethereum-plan-to-slash-quantum-safe-privacy-costs)

A [post on the Ethereum Research forum](https://ethresear.ch/t/exposing-an-isa-for-post-quantum-proofs-on-ethereum/26136) published on October 8 sets out the next design decision for Ethereum's post-quantum path. [EIP-8288](https://eips.ethereum.org/EIPS/eip-8288) lets a transaction depend on post-quantum signatures (leanSPHINCS) and Scalable Transparent Arguments of Knowledge (STARKs) built with leanSTARK, and the Ethereum Virtual Machine (EVM) does not verify either of them. Each dependency is carried as a frame inside an EIP-8141 frame transaction. Nodes check it before they forward the transaction, and every block carries a single recursive STARK that proves all of that block's dependencies are valid.

The open question is the computation model. The draft identifies each proof's program by a verification key hash, and the post calls that hash a placeholder "until Ethereum decides what to expose." Ethereum would then have to choose the instruction set architecture (ISA) in which those programs are written. According to the post, that choice determines how fast users can generate proofs on their own devices and which new cryptography applications can adopt without a protocol change. Privacy pools are the first beneficiary. Under the design, a pool contract does not run a verifier. It only checks that the transaction depends on a proof for its own circuit with the expected public inputs.

The cost numbers explain the urgency. Post-quantum signatures today are 2 to 3 kilobytes and cost 150,000 to 200,000 gas to verify, [Crypto Briefing reports](https://cryptobriefing.com/eip-8288-recursive-stark-mempools-ethereum/). The EIP allows at most 16 leanSPHINCS signatures and one leanSTARK proof per transaction. Vitalik Buterin wrote EIP-8288, which was merged into the EIP repository on September 9. He argues that private transactions costing about 10 million gas to make quantum-safe today [could fall to tens of thousands](https://decrypt.co/377857/vitalik-buterin-pushes-ethereum-plan-to-slash-quantum-safe-privacy-costs). Aggregation takes place in the mempool and at block builders, outside of consensus. That design gives more work, and more trust, to builders.

Two other forum posts this week target the same Lean Ethereum base layer. [One shows](https://ethresear.ch/t/the-unleashed-power-of-stacking-eez-fcr-seen-through-an-example/26133) that stacking the Fast Confirmation Rule (FCR) with the Ethereum Economic Zone (EEZ) could let a user holding ether on a rollup pay at a card terminal with no bridge and no intermediary, with confirmation in about two slots today and less as slot times shrink. [Another revisits](https://ethresear.ch/t/price-of-censorship-resistance-in-multiple-proposer-protocols-under-sybils/26131) a paper by Saraf and co-authors on the cost of censoring transactions when several proposers build blocks at once, and asks how that cost changes when one actor controls many proposer identities.

## What this means

The mechanism is cost. If proof verification moves off the EVM and into one aggregated block proof, post-quantum signatures and private transactions stop carrying a gas penalty of several hundred thousand to several million units, and the main obstacle to defaulting to them disappears. Privacy-pool builders and wallet makers gain. Block builders and mempool operators gain responsibility and therefore leverage, because a mempool that aggregates proofs can also decline to aggregate. The market already treats quantum risk as a long-dated Bitcoin custody story. The market has not priced that Ethereum is turning the problem into a near-term engineering choice that other chains will need to answer. The likelier outcome is that the instruction-set debate runs for months, with competing RISC-V and STARK-native camps. A decision would land in a hard fork roadmap within roughly a year, if client teams agree that aggregating proofs in the mempool does not weaken censorship resistance. Evidence that builders can selectively withhold aggregated proofs, or a client team rejecting verification outside the EVM, would prove this read wrong.

## What to watch

- Whether Ethereum core developers schedule EIP-8141 frame transactions for a named hard fork. EIP-8288 cannot ship without them.
- Which instruction set gains support among client teams and zero-knowledge virtual machine builders. The choice sets how fast proofs run on consumer devices.
- Research on whether block builders that aggregate proofs can censor specific privacy transactions. That would shift power to a small set of builders.