A proposal surfaced in the last 48 hours. EIP-8288, allegedly to be included in an upgrade called I-star (the successor to Hegota), aims to make RISC-V the canonical instruction set for Ethereum. The stated goal: drastically reduce the cost of post-quantum privacy. No official Ethereum Improvement Proposal repository entry exists under that number. The upgrade names I-star and Hegota do not match any known milestone from the Pectra or Fusaka epochs, nor the Verge-Surge-Scourge-Purge-Splurge framework. This gap is the story.
Context matters here. Ethereum’s execution layer currently runs on the Ethereum Virtual Machine (EVM), a 256-bit stack machine with a limited opcode set optimized for accounting and state transitions over cryptographic proofs. The EVM is notoriously hostile to zero-knowledge proof systems: a single keccak256 hash costs 30 gas and requires 60+ circuit constraints in a zk-SNARK. Post-quantum signature schemes like SPHINCS+ or Falcon are orders of magnitude worse—verifying one SPHINCS+ signature on EVM would cost over a million gas due to repeated hashing and hash-based tree traversal. This is the core problem EIP-8288 claims to solve.
RISC-V, by contrast, is a modular, open-standard instruction set architecture (ISA). It is already the darling of the zkVM space: projects like RISC Zero, Succinct, and zkMIPS build their provable virtual machines on RISC-V because its simple, unprivileged specification allows efficient circuit generation. The logic is elegant: if Ethereum’s execution layer could be proven via a RISC-V zkVM, then every transaction on L1 becomes verifiable in zero-knowledge with minimal overhead. Post-quantum primitives, which are also hash-based and lattice-based, fit naturally into RISC-V’s computational model because they compile down to bitwise and arithmetic operations that circuit compilers handle efficiently.
But the proposal does not stop at ZK-friendliness. It explicitly frames cost reduction for "quantum-safe privacy" as the priority. This is a subtle but critical shift in narrative. For years, Ethereum’s post-quantum resistance was framed as a long-term existential threat—something to worry about in the 2040s. The phrase “harvest now, decrypt later” has been used by cryptographers to argue for early migration, but the community largely ignored it because swapping ECDSA for SPHINCS+ would bloat transaction sizes by 10,000%. EIP-8288 suggests that by rewriting the base instruction set, Ethereum can absorb that bloat without breaking user economics. This is not just security; it is a cost play.
Allow me to unpack the technical assumptions. Based on my audit experience with EVM-based contracts that use BLS signature aggregation and hash commitments, I estimate that a post-quantum signature verification on the current EVM consumes at least 250,000 gas under optimistic conditions. A typical DeFi transaction costs around 100,000 gas. That means a single signature check would more than triple the cost of every interaction. If RISC-V becomes the canonical instruction set, and the EVM is compiled to a RISC-V bytecode that targets a zkVM, the verification cost could drop to the equivalent of 10,000 gas or less—two orders of magnitude reduction. The catch is that the entire execution environment changes. Solidity smart contracts cannot run directly on RISC-V; they must be compiled through a new backend (like LLVM) that emits RISC-V machine code instead of EVM bytecode. This is not a soft fork. It is a hard fork that rewrites the compiler, the toolchain, and every audit firm’s playbook.
Here is where the source discrepancy becomes a signature of unintended consequences. The names I-star and Hegota have zero historical footprint in Ethereum core developer meetings—ACD (All Core Devs) calls #141 to #200, which cover the transition from Shapella to Dencun to Pectra, never mention these terms. Hegota sounds like a portmanteau of “Hedgehog” and “Kota,” which is atypical for Ethereum’s star-themed naming convention (Venus, Neptune, etc.). I-star could be a stylized version of “Istanbul” or a placeholder for an upgrade starting with ‘I’ (the next after Pectra would be “Prague” then maybe “Illinois,” but that is speculation). The most plausible explanation is that the original article mistranslated or recast source material. For example, a discussion on the Ethereum Magicians forum about “post-quantum migration as part of the Verge upgrade” could have been rewritten as “I-star upgrade.” This is a second signature of unintended consequences: once a technical idea enters the secondary media ecosystem, it gets branded, aliased, and distorted before reaching the public.
Let us examine the core technical trade-offs systematically.
- Backward compatibility: EVM has ~15 years of deployed contracts, most of which are unmodifiable. A RISC-V native execution engine would require a compatibility shim—either run a full EVM interpreter on RISC-V (defeating performance gains) or mandate that all new contracts target the new ISA. The latter would create a permanent historical split: old DeFi protocols become legacy nodes requiring specialized clients. This has been tried before (e.g., Ethereum Classic splits, Parity’s WASM transition) and it always fractures liquidity and developer attention.
- Security assumptions: The current security model of Ethereum relies on ECDSA signatures on secp256k1. Post-quantum cryptography (PQC) introduces assumptions about lattice hardness or hash function security. RISC-V adds its own implementation correctness assumptions—specifically, that the compiler and the zk-prover circuit match the ISA specification exactly. Formal verification of the compilation pipeline becomes non-negotiable. This is a level of rigor that most blockchain projects, including Ethereum, have not attained at the protocol level.
- Performance metrics: The proposal lacks concrete benchmarks. It claims a “slash” in costs but provides no expected gas savings for common operations like STORE, SSTORE, or CALL. Without numbers, this is a narrative, not an engineering plan. My own back-of-the-envelope calculation, based on RISC-V register width (64-bit) vs. EVM’s 256-bit stack, suggests that arithmetic operations like addition or multiplication could become 4x faster in RISC-V, but at the cost of wider programs (more instructions for the same task). The net effect on gas might be neutral unless the gas cost model is adjusted.
- Ecosystem coordination: The ZK ecosystem will be the biggest beneficiary. Every zkVM project that compiles Rust to RISC-V can now claim “Ethereum compatibility at the execution layer.” This is a third signature of unintended consequences: the proposal could tilt Ethereum’s growth toward a ZK-centric roadmap, marginalizing the optimistic rollup camp and the EVM-equivalent crowd. ConsenSys, which relies heavily on Solidity tooling, faces an existential dilemma: invest in RISC-V tooling or lose mindshare.
Now, the contrarian angle. The primary blind spot in every article I have read on this topic is the assumption that the proposal is real. The absence of a verified EIP-8288 in the official ethereum/EIPs repository suggests this is either a draft that has not been published or a fabrication from a source that conflated multiple proposals. The Ethereum Foundation does not usually announce speculative upgrades without a soft ACD review. If I were a trader, I would treat this as noise and search for the original Ethereum Magicians thread. The second blind spot is the timeline. The proposal ties this to “I-star, after Hegota.” If Hegota is not on the roadmap, the timeline is indefinite. In blockchain terms, indefinite means “maybe never.” The community will forget this in two weeks unless Vitalik retweets it.
The deeper blind spot is the assumption that lowering post-quantum costs is the bottleneck for privacy adoption. Privacy on Ethereum today suffers from high on-chain data costs, not cryptographic verification costs. Tornado Cash’s latest version uses Groth16 proofs that are already cheap to verify (under 500,000 gas). The real problem is that every private transfer requires ~50,000 data bytes of commitments and nullifiers. RISC-V does not compress data; it only makes computation cheaper. Unless data availability (DA) costs also drop—through EIP-4844 or data sharding—the privacy cost reduction will be marginal.
Takeaway. EIP-8288, if it exists, represents a visionary but premature pivot. Ethereum’s long-term architectural evolution will likely converge on a modular execution engine that separates consensus from execution and allows multiple VMs (EVM, RISC-V, WASM) to coexist via a super-validator pattern. This proposal, however, frames itself as a singular replacement, not a coexistence path. That is either a misreading of the source or a deliberate provocation. The market should ignore it until an official ACD update confirms the upgrade name. Until then, the only signal is that the ZK-zkVM narrative is slowly consuming Ethereum’s research bandwidth. If you are building a protocol that relies on EVM tooling, prepare for a world where you might need a RISC-V backend. If you are investing, wait for the gas metric.