Evaluate RIP-7212 P-256 precompile on Heima (~707k→~3.4k gas/verify; Pectra-independent)

[hanwencheng]

Status (2026-06-04): dependency updated → now blocked on litentry/heima#4030 (the parachain team implemented the precompile). See ## Status below for resolved-vs-pending.

Status (2026-06-04)

Decision = precompile (the ~200× win). The parachain team scoped, decided, and implemented it: litentry/heima#4030 registers the RIP-7212 P-256 precompile at 0x100 on both the heima + paseo runtimes — an own implementation over the RustCrypto p256 crate (already a workspace dep), flat 3450 gas, RIP-7212 I/O (160-byte hash‖r‖s‖x‖y → uint256(1) on valid / empty on invalid-or-malformed, never reverts), registered with EthereumPrecompilesChecks (delegatecall-safe; low-s not enforced, per FIPS-186-5). This resolves Action items 1–2 below (scope + decide).

Now blocked on #4030, which is open against dev and ships code only: spec_version stays at 9261 and on-chain activation is a separate governance step (authorizeUpgrade / setCode). The precompile is not live on Heima mainnet yet.

Remaining agentKeys-side work (Action item 3 — gated on #4030 merging and the 9261 runtime upgrade activating on mainnet):

1. Repoint E2's verifier config interface from the daimo pure-Solidity P256Verifier (0xda5b772f9d6c09abe80414eea908612df9b54749, ~707k gas) to the 0x100 precompile — one place, per docs/plan/chain/erc4337-master-account.md §2 (constraint 5) / E2 / §11.
2. Re-verify on Heima mainnet: valid vector → 0x…01, tampered → empty; full passkey UserOp gas drops from ~730k → ~tens-of-k.
3. Record the 0x100 precompile in docs/spec/deployed-contracts.md and update the §2 / §11 plan references once live.

---

Summary

Evaluate registering a RIP-7212 secp256r1 (P-256) precompile at 0x100 on Heima. It would cut on-chain P-256 verification from ~707k gas → ~3.4k gas (~200×). Not a blocker for #164 (707k is already ~0.018 HEI/verify at 25 gwei), but the single highest-value chain-side optimization for AgentKeys' passkey/UserOp path — and independent of Pectra (RIP-7212 has shipped on many L2s separately from any mainnet hardfork).

Evidence (measured on Heima mainnet, 2026-06-02)

• Live P256Verifier (pure-Solidity, 0xda5b772f9d6c09abe80414eea908612df9b54749) verifies correctly; one verify(...) costs ~707k gas (measured).
• A full P-256 passkey UserOp (EntryPoint v0.7 + minimal account → live verifier) landed at 730,242 gas total — the verify dominates.
• Heima exposes no precompile at 0x100/0x0b today (Complete real browser-side wiring of the master plane (parent-control web app) #163).

Why it's feasible

• RIP-7212 is a Frontier precompile registration, not new crypto; the p256 crate is already a Heima dependency (per Complete real browser-side wiring of the master plane (parent-control web app) #163). Needs a runtime upgrade.
• Independent of Prague/Pectra (unlike EntryPoint v0.8 — tracked separately).

Cheaper interim option (no chain work)

Swap our pure-Solidity verifier for the Daimo P256Verifier (~421k gas, ~40% cut) — usable in #164 E2 with zero chain changes.

Action

• Scope the Frontier precompile registration + runtime-upgrade cost with the parachain team.
• Decide: precompile (200× win, needs upgrade) vs Daimo swap (40% win, no upgrade) vs status quo (707k, fine today).
• If adopted, Migrate master authority to an ERC-4337 P-256 smart-account (resolves §11 gating findings) #164 E2's verifier reference swaps in one place (kept behind a config interface).

See also

• Migrate master authority to an ERC-4337 P-256 smart-account (resolves §11 gating findings) #164 — ERC-4337 P-256 master (consumer of this).
• docs/plan/chain/erc4337-master-account.md §2 (constraint 5).