---
eip: 8149
title: Multi KZG Point Evaluation Precompile
description: Verify multiple (z, y) evaluations against a single EIP-4844 blob commitment in one precompile call.
author: Chris Mata (@protocolwhisper)
discussions-to: https://ethereum-magicians.org/t/eip-8149-multi-kzg-point-evaluation-precompile/27671
status: Draft
type: Standards Track
category: Core
created: 2026-02-06
requires: 4844
---

## Abstract

Add a precompile that verifies multiple KZG openings `(z_i, y_i)` for a single [EIP-4844](./eip-4844.md) blob commitment, returning the same 64-byte output as the existing point-evaluation precompile.

## Motivation

[EIP-4844](./eip-4844.md) provides a point-evaluation precompile at `0x0A` costing 50,000 gas per opening. Contracts needing multiple blob values (e.g., fraud proofs) must pay this cost repeatedly. A batch interface verifies *k* openings in one call, reducing overhead.

## Specification

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC 2119](https://www.rfc-editor.org/rfc/rfc2119) and [RFC 8174](https://www.rfc-editor.org/rfc/rfc8174).

### Constants

| Name | Value | Comment |
| - | - | - |
| `MULTI_POINT_EVALUATION_PRECOMPILE_ADDRESS` | `TBD` | precompile address |
| `MAX_MULTI_POINTS` | `128` | maximum number of evaluation points |
| `MULTI_POINT_EVALUATION_BASE_GAS` | `TBD` | base gas cost |
| `MULTI_POINT_EVALUATION_PER_POINT_GAS` | `TBD` | gas cost per evaluation point |

We introduce a precompile to perform multi KZG point evaluation:

It verifies multiple KZG openings `(z_i, y_i)` for a single EIP-4844 blob commitment in one call. The verification uses BLS12-381 pairing operations internally to check the multi-point opening proof. Gas cost is defined by `MULTI_POINT_EVALUATION_BASE_GAS + MULTI_POINT_EVALUATION_PER_POINT_GAS * n` where `n` is the number of evaluation points.

### Input

```
versioned_hash  : Bytes32
commitment      : Bytes48
n               : uint32 (big-endian)
pairs           : n × (z: Bytes32, y: Bytes32)
proof           : Bytes48
```

Total length: `132 + (n × 64)` bytes. All `z` and `y` MUST be strictly less than `BLS_MODULUS`.

### Output

On success, return 64 bytes identical to [EIP-4844](./eip-4844.md):

```
FIELD_ELEMENTS_PER_BLOB  : uint256 (big-endian)
BLS_MODULUS              : uint256 (big-endian)
```

### Multi-point evaluation precompile

Add a precompile at `MULTI_POINT_EVALUATION_PRECOMPILE_ADDRESS` that verifies multiple KZG openings `(z_i, y_i)` for a single EIP-4844 blob commitment.

The precompile executes the following logic:

```python
def multi_point_evaluation_precompile(input: Bytes) -> Bytes:
    versioned_hash = input[:32]
    commitment = input[32:80]
    n = int.from_bytes(input[80:84], 'big')
    
    assert 1 <= n <= MAX_MULTI_POINTS
    assert len(input) == 132 + n * 64
    
    z_values, y_values = [], []
    for i in range(n):
        offset = 84 + i * 64
        z_i = int.from_bytes(input[offset:offset+32], 'big')
        y_i = int.from_bytes(input[offset+32:offset+64], 'big')
        assert z_i < BLS_MODULUS and y_i < BLS_MODULUS
        z_values.append(z_i)
        y_values.append(y_i)
    
    proof = input[84 + n*64 : 84 + n*64 + 48]
    
    assert kzg_to_versioned_hash(commitment) == versioned_hash
    assert verify_kzg_proof_multi(commitment, z_values, y_values, proof)
    
    return U256(FIELD_ELEMENTS_PER_BLOB).to_be_bytes32() + U256(BLS_MODULUS).to_be_bytes32()
```

The `verify_kzg_proof_multi` function performs multi-point opening verification using the [EIP-4844](./eip-4844.md) trusted setup and BLS12-381 pairing operations. Implementations typically use Lagrange interpolation to construct a polynomial through all `(z_i, y_i)` pairs, which has O(n²) complexity. When evaluation points align with roots of unity, FFT-based methods reduce this to O(n log n). The final verification step uses a single pairing check to verify all openings simultaneously.

### Gas Cost

The gas cost for multi point evaluation is:

```python
def gas_cost(n: int) -> int:
    return MULTI_POINT_EVALUATION_BASE_GAS + MULTI_POINT_EVALUATION_PER_POINT_GAS * n
```

Gas constants SHOULD ensure batching is cheaper than `n` separate `0x0A` calls for `n > 1`. The verification internally uses BLS12-381 pairing operations, which are computationally expensive but enable efficient batch verification of multiple openings.

## Rationale

- Preserves [EIP-4844](./eip-4844.md) versioned-hash model and return format.
- Adds a new precompile rather than modifying `0x0A` to avoid compatibility risks.
- `MAX_MULTI_POINTS = 128` bounds input size while enabling meaningful savings.

## Backwards Compatibility

No changes to [EIP-4844](./eip-4844.md) transactions, `BLOBHASH`, or the existing precompile at `0x0A`.

## Security Considerations


- Reject non-canonical field elements (`>= BLS_MODULUS`).
- Implementations MUST use the same trusted setup and subgroup checks as [EIP-4844](./eip-4844.md).
- Gas pricing MUST reflect actual computational cost.

## Copyright

Copyright and related rights waived via [CC0](../LICENSE.md).