P-256 Precompile Goes Live on HeLa Mainnet — Passkeys Are Now Native
Today HeLa activated the EIP-7951 P-256 precompile on mainnet. Every validator and compute node on Chain ID 8668 now verifies P-256 signatures natively -- the same curve your phone uses for Face ID, Touch ID, and passkeys.
This is not a smart contract deployment. It is a protocol-level upgrade that went through on-chain governance, node binary updates across 13 servers, and automatic activation at epoch 26,021.
What Changed
A new precompile at address 0x0000000000000000000000000000000000000100 accepts a 160-byte input (message hash + signature + public key) and returns whether the P-256 ECDSA signature is valid.
Before: Verifying a P-256 signature in Solidity cost ~300,000 gas (elliptic curve math on-chain). After: 3,450 gas. Fixed. Predictable. An 87x reduction.
The Path Here
This upgrade went through five stages over two weeks:
| Stage | Date | What |
|---|---|---|
| Code review | Apr 10 | ~280 lines of Rust, 8 unit tests, RustCrypto p256 crate (zkSecurity audited) |
| Devnet validation | Apr 10-15 | 8/8 tests passed on isolated devnet (54.251.196.3) |
| Security audit | Apr 14 | Seth audit: 0 critical, 0 high. GO-WITH-FIXES for deployment |
| Testnet activation | Apr 15 | Governance vote, all 8 testnet nodes upgraded. 8/8 tests passed on public testnet |
| Mainnet activation | Apr 23 | Governance vote, all 13 mainnet nodes upgraded. Epoch 26,021 activation |
EIP-7951: Why Not RIP-7212
Most chains that support P-256 (Polygon, Optimism, Arbitrum, Base, zkSync) use RIP-7212. HeLa runs EIP-7951's validation logic -- the security-hardened version with additional input validation:
- Point-at-infinity rejection on the recovered point R' -- RIP-7212 does not check for this edge case
- Modular comparison
r' ≡ r (mod n)instead of plain equalityr' == r - r/s boundary enforcement -- r = 0, s = 0, r >= curve order are all rejected
- Same address, same interface -- fully compatible with existing RIP-7212 tooling
HeLa's implementation runs EIP-7951's validation logic at RIP-7212's gas pricing (3,450 gas). Ethereum L1 priced the same logic at 6,900 gas in Fusaka based on different benchmarking. Source for HeLa's gas constant: oasis-sdk/runtime-sdk/modules/evm/src/precompile/p256verify.rs.
The stricter validation prevents edge-case signature malleability attacks. For infrastructure that will be called by every smart account and credential verifier on the chain, this is the right default.
How We Win
Same precompile address (0x100), same call interface — different validation depth and a different alignment story.
HeLa's P-256 precompile runs the EIP-7951 input-validation logic (point-at-infinity rejection on the recovered point R', modular comparison r' ≡ r (mod n) instead of plain equality) at the 3,450 gas cost defined by RIP-7212. Ethereum L1 shipped the same EIP-7951 validation at 6,900 gas in the Fusaka upgrade (December 2025); the L1 gas was raised based on benchmarking against ECRECOVER. HeLa kept the lower number based on our own runtime measurements. Source for HeLa's gas constant: oasis-sdk/runtime-sdk/modules/evm/src/precompile/p256verify.rs.
The result: Ethereum L1's validation correctness with L2-rollup-level pricing.
| Chain | Spec | Gas | Point-at-Infinity (R') | Modular r ≡ r' (mod n) | Source |
|---|---|---|---|---|---|
| HeLa Mainnet | EIP-7951 validation @ RIP-7212 pricing | 3,450 | rejected | enforced | this post |
| Ethereum L1 (Fusaka) | EIP-7951 | 6,900 | rejected | enforced | spec |
| Polygon | RIP-7212 | 3,450 | not checked | plain equality | Alchemy |
| Optimism (Fjord) | RIP-7212 | 3,450 | not checked | plain equality | OP Stack specs |
| Base | RIP-7212 | 3,450 | not checked | plain equality | OP Stack specs |
| Arbitrum (ArbOS 31 "Bianca") | RIP-7212 | 3,450 | not checked | plain equality | Arbitrum AIP |
| zkSync | RIP-7212 | 3,450 | not checked | plain equality | Alchemy |
| Scroll | RIP-7212 | 3,450 | not checked | plain equality | RIP-7212 spec |
Two practical consequences for builders:
- Drop-in tooling parity — same address, same 160-byte input, same return shape. Existing RIP-7212 SDKs, AA-account templates, and passkey-signer libraries (Privy, Turnkey, ZeroDev, Alchemy AA) work against HeLa with zero migration effort.
- Forward-aligned with Ethereum L1 — chains running RIP-7212 will eventually face pressure to migrate to the security-hardened spec; HeLa already runs the hardened validation today.
The trade we made: pick the harder validation now (per EIP-7951's threat analysis) and keep RIP-7212 gas pricing because passkey infrastructure will be called by every smart account on the chain — at that scale, edge-case strictness compounds. Read the full technical breakdown in HIP-001.
Sources:
- EIP-7951 spec
- RIP-7212 spec
- Ethereum Fusaka Upgrade dev guide (Alchemy, 2025)
- What is RIP-7212? (Alchemy)
- OP Stack precompiles spec
- Arbitrum AIP: Support RIP-7212 (ArbOS 31 "Bianca")
- HeLa P-256 implementation source:
oasis-sdk/runtime-sdk/modules/evm/src/precompile/p256verify.rs
Try It
Call the precompile from Solidity:
function verifyP256(
bytes32 msgHash,
bytes32 r, bytes32 s,
bytes32 pubX, bytes32 pubY
) internal view returns (bool) {
(bool success, bytes memory result) = address(0x100).staticcall(
abi.encodePacked(msgHash, r, s, pubX, pubY)
);
return success
&& result.length == 32
&& abi.decode(result, (uint256)) == 1;
}
Important: HeLa mainnet runs London EVM. Compile with --evm-version london.
| Network | Chain ID | RPC | Status |
|---|---|---|---|
| Mainnet | 8668 | https://mainnet-rpc.helachain.com | LIVE |
| Testnet | 666888 | https://testnet-rpc.helachain.com | LIVE |
What This Unlocks
Passkey wallets. ERC-4337 smart accounts with Face ID / Touch ID as the signer. No seed phrase. No browser extension. The phone's Secure Enclave generates a P-256 key pair, the public key goes on-chain, and every action is signed biometrically.
Cheaper onboarding. HeLa's Citizen ID flow uses ERC-4337 with a Paymaster for gasless signups. Signature verification cost drops from ~0.09 HLUSD to ~0.035 HLUSD per signup -- a 61% reduction that makes subsidized onboarding sustainable at scale.
WebAuthn native. FIDO2 authenticator assertions can now be verified on-chain without an oracle. Login, credential issuance, identity verification -- all directly in Solidity.
HSM compatibility. P-256 is the standard curve for banking HSMs, smart cards, and payment terminals. On-chain verification of HSM-signed data is now economically viable on HeLa.
The Deployment
The mainnet upgrade touched 13 servers:
- 5 validator nodes (consensus)
- 5 compute nodes (block production + transaction execution)
- 3 client nodes (RPC queries)
- 2 web3 gateway nodes (EVM RPC interface)
The new runtime binary (.orc) and web3 gateway were built by Quan using HeLa's official builder toolchain, registered on-chain for epoch 26,021, and pushed to all nodes via the deployment system. Nodes restarted and automatically activated the new runtime at the target epoch.
Zero downtime. Zero manual binary replacement. The chain never stopped producing blocks.
Credits
- Quan -- Implementation (Rust), builder compilation, testnet + mainnet governance activation
- Rian -- Node management, server access, binary distribution
- Devon -- Test harness (8-test suite), devnet + testnet + mainnet verification
- Seth -- Security audit of p256verify.rs
- KC -- Deployment coordination, mainnet deploy execution
The P-256 precompile is live now on HeLa Mainnet (Chain ID 8668) at 0x0000000000000000000000000000000000000100. Full technical documentation available. Compatible with all existing RIP-7212 tooling.