EEVM.Precompiles.KZGPointEval (eevm v0.1.0)

Copy Markdown View Source

KZG point evaluation precompile — address 0x0A (EIP-4844).

The precompile flow:

  1. Validate the versioned_hash derived from the commitment.
  2. Validate field element bounds for the evaluation point z and value y.
  3. Verify the KZG proof for (commitment, z, y, proof).

Gas schedule

Flat 50,000 gas per call.

Input format (exactly 192 bytes)

  • bytes 0..31 — versioned_hash (32 bytes)
  • bytes 32..63 — z evaluation point (32 bytes, big-endian field element)
  • bytes 64..95 — y claimed evaluation (32 bytes, big-endian field element)
  • bytes 96..143 — commitment (48 bytes)
  • bytes 144..191 — proof (48 bytes)

Output format

Exactly 64 bytes: two big-endian uint256 values:

  • FIELD_ELEMENTS_PER_BLOB (4096)
  • BLS_MODULUS

Proof verification

The 48-byte commitment and proof are compressed G1 points (ZCash serialization, as in the consensus specs' bytes_to_kzg_commitment). They are decompressed and checked to be in G1, and the KZG check

e(C − [y]G1, G2) = e(π, [τ]G2 − [z]G2)

is evaluated in the equivalent form e(C − [y]G1 + [z]π, −G2) · e(π, [τ]G2) = 1: one G1 multi-scalar multiplication and one two-pair pairing check, both from EEVM.Precompiles.Bls12381.Curve. Of the trusted setup, only [τ]G2 is needed.