Ethereum’s privacy push hits a numbers problem: one proof needs nearly twice the proposed gas allowance

A Sept. 5 proposal would let some Ethereum nodes accept privacy transactions that exceed a shared validation allowance, without ensuring those transactions travel across the public network. The proposed 100,000-gas guarantee remains below the proof-verification cost reported in a new privacy benchmark.

The open change to EIP-8141, Ethereum’s proposed Frames transaction design, was submitted by contributor AnkushinDaniil. It would turn the existing validation maximum into a common floor: nodes would have to propagate qualifying transactions within it, while capable nodes could accept more expensive ones locally. The proposal remains under review.

For Tornado Cash and RAILGUN designs studied in the benchmark, replacing off-chain relayers with public submission requires proofs that nodes will accept and pass along. Allowing some nodes to accept heavier transactions would not guarantee wider network support.

The proof still exceeds the allowance

The current EIP-8141 draft caps signature checks and execution in the initial validation phase through payment approval at 100,000 gas. Gas measures computational work here, rather than a fixed fee in dollars. The limit is intended to contain node workload and denial-of-service exposure.

A Sept. 2 benchmark by mmjahanara reports an optimized Groth16 proof verifier requiring 190,628 gas. Its cryptographic pairing check alone accounts for 181,000 gas, already above the proposed public allowance.

The full model reports minimums of 211,828 gas for a single-note spend and 351,828 for an eight-note spend. These modeled minimums combine verifier measurements with estimated overhead and a 20,000-execution-gas charge per nullifier, an identifier used to prevent spending a note twice. CryptoSlate has not independently rerun the benchmark.

That accounting differs from the current EIP-8250 companion draft. It charges fresh nonce keys to state gas, a separate budget, rather than execution gas. The benchmark’s totals therefore describe its model, not verified costs under the latest combined proposals. That accounting difference does not remove the reported verifier’s execution-cost gap.

Benchmark author mmjahanara recommends at least 250,000 gas for typical optimized transactions. That recommendation has not been adopted, and it would remain below the model’s eight-note total.

The model also assumes application changes: moving non-verification work into later frames, optimizing verifiers and compressing proof inputs. The model’s SHA-256 compression option increases the work required to generate proofs on users’ devices.

For users, a larger allowance would address one obstacle. EIP-8250 still preserves one pending public-mempool transaction per sender, another constraint for privacy designs sharing an address.

Public propagation is also distinct from block validity. EIP-8141 allows transactions outside its public rules into local or private mempools. Separately, the informational EIP-8369 proposal describes future rules to enforce transaction inclusion, including for custom or direct submission. It requires a binding protocol extension.

The practical decision is how to accommodate privacy-proof validation while bounding node work. The September proposal offers optional flexibility at individual nodes. Guaranteed public access for the studied privacy designs would still require accommodating their proof costs across the network.