[ilitteri]

The specification depends on three properties of the aggregation circuit. It states two of them as observations about one implementation, and does not state the third at all, though the mempool loop depends on it entirely.

The two currently asserted:

The bandwidth overhead of recursive STARKs is constant per peer, regardless of the number of transactions.

the STARK-related overhead for the builder is a fixed ~256 kB per AGGREGATION_INTERVAL milliseconds

The third, bounded absorption cost, is what makes "a mempool node broadcasts exactly one wrapper containing all currently active transactions" achievable. Only if absorbing the previous round's aggregate has a bounded cost whatever it covers does a node's per-round cost stay bounded as its pool grows.

As requirements rather than observations they give a bound on stark_proof something to rest on, make AGGREGATION_INTERVAL satisfiable by construction rather than by measurement, and mean a circuit that breaks the economics fails a stated requirement instead of silently invalidating Rationale and Censorship Resistance. Each requirement is a bound by a constant, so a proof of fewer claims may still be cheaper.

The Gas Accounting sentence follows from the third property. verification_gas is charged per dependency, which prices establishing one for the first time. It does not price a recursive round, because the cost of absorbing a nested proof is bounded whatever it covers. The reasoning for both is in Rationale, under a new entry and under the existing Gas costs.

We implemented this EIP against a working leanVM backend and measured all three properties. Proof size moved from 225 KB to 305 KB across a 128-fold increase in dependencies; verification stayed between 3 and 10 ms over that range; absorbing children covering 8, 16 and 32 dependencies took 295, 273 and 237 ms. Those figures belong to one revision on one machine and will change, which is the reason to propose the properties rather than the numbers. None of the three is flat, and all stay bounded, which is what the requirements now ask.

[eth-bot]

File EIPS/eip-8288.md

Requires 1 more review from Authors: @tcoratger, @vbuterin

[vbuterin]

I would say "bounded by a constant" for (2) just like (1)

it's okay if proofs of smaller/fewer claims are cheaper across all dimensions as long as there is a bound.

Though another idea is that instead we assert as an assumption the maximum size of a statement, and prove that it will be hold based on other assumptions, eg. number of peers and anti-DoS limits. You only get one recursive proof per mempool peer, plus you can throttle to <= k txs per connected user.

[manusw7]

Nice to have these as requirements instead of observations, and the "bounded by a constant" wording addresses Vitalik's comment. Two things:

1. Requirement 3 conflicts with the circuit as specified. Absorbing a nested proof takes inner_deps as private input, hashes it (get_deps_hash(inner_deps)), merges, dedups and re-hashes the union, so absorption cost grows with how many deps the child covers. A constant bound only holds if the statement size is bounded, which is basically Vitalik's alternative. Maybe phrase all three as "bounded by a constant for any statement within the protocol limits" and point at the cap.
2. New Gas Accounting sentence vs recursive_stark_gas. It says LEANSTARK_VERIFICATION_GAS doesn't price a recursive round, but a few lines down recursive_stark_gas(tx) uses that same constant to price the tx's share of the block's recursive STARK. Maybe scope the sentence to verification_gas only.