EIP-8224: Counterfactual Transaction
Author: Ben Adams (@benaadams) Status: Draft (PR #11518) | Category: Core (Standards Track) Created: April 12, 2026 Requires: EIP-196, EIP-197, EIP-1559, EIP-2718, EIP-2780, EIP-3529, EIP-4788, EIP-6780, EIP-7708, EIP-7904
At a Glance
What it is. A shielded-gas-funding transaction type (0x08) carrying an fflonk ZK proof that the sender owns an unspent fee note in a canonical fee-note contract.
Problem it solves. The bootstrap problem for private transactions. A fresh EOA with no ETH cannot pay gas privately today, because receiving ETH from any source creates a traceable on-chain link to the depositor. EIP-8224 lets the new account pay for its first transaction using a privately-linked fee note instead of an observable ETH transfer.
Why an EIP-8141 reader should care. It composes with EIP-8141 and EIP-8223 into a three-layer stack, where each layer solves a distinct problem: general AA (8141), static sponsorship (8223), and shielded bootstrap (8224). It is also the only proposal on this page that directly targets privacy rather than account abstraction, which makes it useful for understanding what EIP-8141's privacy story does and doesn't cover.
Overview
EIP-8224 introduces a new EIP-2718 transaction type (0x08) for protocol-native shielded gas funding using ZK proofs against canonical fee-note contracts. It addresses a problem that remains even after EIP-8223: a fresh EOA with no ETH cannot pay gas privately, because receiving ETH from any source creates a traceable on-chain link.
The flow:
- A user deposits ETH into a canonical fee-note contract instance (recognized by runtime code hash, not a fixed address), receiving a private Poseidon commitment.
- Later, from a fresh EOA, the user submits a counterfactual transaction carrying an fflonk ZK proof (over BN254) that they own an unspent fee note sufficient to cover gas.
- The protocol verifies the proof (no EVM execution required, bounded cryptographic computation plus fixed storage reads), consumes the fee note's nullifier, settles gas, and sends any leftover ETH to a designated
gas_refund_recipient. - The transaction body executes normally; it can call any contract (privacy pool withdrawal, account setup, etc.).
EIP-8224 is positioned as complementary to EIP-8141, EIP-8175, and EIP-8223 (all from the same benaadams lineage). It targets the bootstrap problem for fresh EOAs that need shielded gas funding before they can use any sponsorship-based mechanism.
Core Design
Code-hash recognition: Fee-note contracts are recognized by EXTCODEHASH, not a fixed predeploy address. Multiple instances can coexist. The transaction names its instance via fee_note_contract, and the proof binds to that address.
fflonk over BN254: Universal setup (reuses existing powers-of-tau), 2-pair pairing verification, ~176K gas proof verification cost. No circuit-specific trusted setup ceremony.
Append-only accepted roots: Deposits add roots that are never revoked. Proofs against older roots remain valid forever, preventing censorship-based griefing.
Arbitrary note values: No fixed denomination tiers. Deposit any ETH amount; the circuit proves fee_denomination == note_value.
Cross-chain protection: chain_id bound in the proof (8 public inputs total) as defense-in-depth against cross-chain replay.
One-shot bootstrap pattern: Used once to fund a smart account and register it in the EIP-8223 payer registry. All subsequent transactions from that account use cheap sponsored transactions.
Mempool Strategy
Validation is bounded cryptographic computation plus a canonical code-hash check plus fixed storage reads. No EVM execution. This places EIP-8224 firmly in the restrictive mempool tier alongside EIP-8223 and the EIP-8141 self-relay/canonical-paymaster prefixes.
Intrinsic Gas Breakdown
| Component | Gas |
|---|---|
| Base (EIP-2780) | 4,500 |
| fflonk proof verification (9 ECMUL + 9 ECADD + 2-pair ECPAIRING) | 176,346 |
| Fee-note state access | 6,800 |
| Fee-note state mutation | 22,500 |
| ETH transfer logs | 3,512 |
| Fixed subtotal | 213,658 |
| Proof calldata (~512 bytes) | ~8,192 |
| Typical minimum total | ~222,000 |
Key Differences from EIP-8141
| Aspect | EIP-8224 | EIP-8141 |
|---|---|---|
| Scope | Shielded gas funding via ZK proofs against fee-note contracts | General-purpose AA: validation, execution, sponsorship |
| New opcodes | None | 5 (APPROVE, TXPARAM, FRAMEDATALOAD, FRAMEDATACOPY, FRAMEPARAM) |
| Validation model | fflonk proof + code-hash check + fixed storage reads, no EVM | Programmable EVM in VERIFY frames |
| Privacy model | Private commitment (Poseidon), nullifier consumption | None natively; relies on out-of-protocol mixers |
| Bootstrap problem | Solved (fresh EOA can pay gas without traceable funding) | Not addressed |
| Composability | Designed to compose with EIP-8223 (one-shot bootstrap, then sponsored txs) | Stand-alone |
| VOPS/FOCIL compatibility | Native (canonical code-hash + fixed storage reads) | Requires bounded state access discipline |
| Async execution | Compatible (no EVM in validation) | Incompatible |
| Cost | ~222K gas typical | Frame transaction overhead, varies by structure |
Activity
- 1 PR (#11518), opened April 12, 2026
- Discussion thread not yet linked
Strengths
- Solves the bootstrap problem: fresh EOAs can fund their first transaction without traceable on-chain links to the depositor. Composable with EIP-8223 (one-shot bootstrap, then sponsored txs).
- Mempool-safe by construction: bounded cryptographic verification plus fixed storage reads, no EVM. Fits the restrictive tier alongside EIP-8223.
- Universal setup (fflonk): no circuit-specific trusted setup ceremony. Reuses existing powers-of-tau.
- Censorship-resistant roots: append-only accepted roots mean old proofs never expire.
Weaknesses
- High intrinsic gas (~222K): designed as a one-shot operation, not a steady-state mechanism.
- Pre-draft artifacts: canonical fee-note bytecode, verification key, circuit artifacts, and cross-client test vectors are not yet published.
- Very early stage: PR opened April 12, 2026. No review cycle yet.
Continue with Competing Standards for the comparative analysis, or return to the Home page.