Precompiles

Precompiles are contracts at predefined addresses that provide cryptographic and utility functions implemented natively rather than in EVM bytecode. They are callable like any other contract via CALL or STATICCALL. Monad supports all Ethereum precompiles as of the Fusaka fork (0x01 to 0x11), plus three additional precompiles:

0x0100 - P256 signature verification (EIP-7951)
0x1000 - Staking precompile
0x1001 - Reserve balance precompile

Ethereum precompiles

Cryptographic and hashing

Address	Name	Gas	Description
`0x01`	`ecRecover`	`6000`	ECDSA public key recovery
`0x02`	`sha256`	`60 + 12 * word_size`	SHA-256 hash function
`0x03`	`ripemd160`	`600 + 120 * word_size`	RIPEMD-160 hash function
`0x09`	`blake2f`	`rounds * 2`	BLAKE2 compression function F

Arithmetic and utility

Address	Name	Gas	Description
`0x04`	`identity`	`15 + 3 * word_size`	Returns the input unchanged
`0x05`	`modexp`	see evm.codes	Arbitrary-precision modular exponentiation

Elliptic curve alt_bn128

Address	Name	Gas	Description
`0x06`	`ecAdd`	`300`	Point addition on alt_bn128
`0x07`	`ecMul`	`30,000`	Scalar multiplication on alt_bn128
`0x08`	`ecPairing`	`225,000`	Bilinear pairing check on alt_bn128

KZG commitment

Address	Name	Gas	Description
`0x0a`	`point_eval`	`200,000`	KZG commitment verification (EIP-4844)

BLS12-381

These precompiles provide operations on the BLS12-381 curve per EIP-2537.

Address	Name	Gas	Description
`0x0b`	`bls12_g1_add`	`375`	Point addition in G1
`0x0c`	`bls12_g1_msm`	see EIP-2537	Multi-scalar multiplication in G1
`0x0d`	`bls12_g2_add`	`600`	Point addition in G2
`0x0e`	`bls12_g2_msm`	see EIP-2537	Multi-scalar multiplication in G2
`0x0f`	`bls12_pairing_check`	see EIP-2537	Pairing check over (G1, G2) point pairs
`0x10`	`bls12_map_fp_to_g1`	`5500`	Map base field element to G1 point
`0x11`	`bls12_map_fp2_to_g2`	`23800`	Map extension field element to G2 point

P256 signature verification

Address 0x0100 verifies signatures on the secp256r1 (P256) elliptic curve per EIP-7951.

EIP-7951 supersedes RIP-7212. If you are migrating from a chain that uses RIP-7212 at 0x100, note that the address and interface are identical — only the EIP designation has changed.

The P256 curve is used by WebAuthn, Apple Secure Enclave, Android Keystore, and hardware security modules. With this precompile, you can verify passkey signatures on-chain, enabling biometric authentication flows for smart accounts without relying on off-chain signature verification.

Input and output

The precompile accepts exactly 160 bytes:

Offset	Size	Parameter	Description
0	32 bytes	`hash`	Message hash
32	32 bytes	`r`	Signature component r
64	32 bytes	`s`	Signature component s
96	32 bytes	`qx`	Public key x-coordinate
128	32 bytes	`qy`	Public key y-coordinate

All values are big-endian encoded as 256-bit unsigned integers. Returns:

0x0000...0001 (32 bytes) on a valid signature
Empty bytes on an invalid signature or malformed input

Gas cost: 6900

Solidity example

address constant P256_VERIFY = address(0x0100);

function verifyP256Signature(
    bytes32 hash,
    uint256 r,
    uint256 s,
    uint256 qx,
    uint256 qy
) internal view returns (bool) {
    (bool success, bytes memory result) = P256_VERIFY.staticcall(
        abi.encodePacked(hash, r, s, qx, qy)
    );
    return success && result.length == 32 && abi.decode(result, (uint256)) == 1;
}

For passkey infrastructure and embedded wallet providers on Monad, see Embedded Wallets.

Staking precompile

Address 0x1000 provides the interface for validator delegation, undelegation, reward claims, and staking queries. Gas costs vary by function.

Staking overview — key concepts, common actions, and constraints
Staking API reference — full method signatures, parameters, gas costs, events, and ABI

Reserve balance precompile

Address 0x1001 exposes a single method, dippedIntoReserve() (selector 0x3a61584e, gas cost 100), which returns a bool indicating whether the current execution state is in reserve balance violation. It is specified in MIP-4. dippedIntoReserve() must be invoked via CALL. Invoking it via STATICCALL - or via DELEGATECALL or CALLCODE - reverts. Although it reads state and returns a value, it is intentionally not a view function, so that a Solidity call site compiles to CALL rather than STATICCALL.

Gas pricing differences

A few precompiles (0x01, 0x06, 0x07, 0x08, 0x09, 0x0a) are repriced relative to Ethereum to reflect their relative costs in Monad’s execution environment. The gas values in the tables above reflect Monad’s pricing. See Opcode pricing for a comparison.

Source code

See the precompile implementation.

Introduction

Developer Essentials

Tooling and Infrastructure

Reference

Guides

Resources

Ethereum precompiles

Cryptographic and hashing

Arithmetic and utility

Elliptic curve alt_bn128

KZG commitment

BLS12-381

P256 signature verification

Input and output

Solidity example

Staking precompile

Reserve balance precompile

Gas pricing differences

Source code

​Ethereum precompiles

​Cryptographic and hashing

​Arithmetic and utility

​Elliptic curve alt_bn128

​KZG commitment

​BLS12-381

​P256 signature verification

​Input and output

​Solidity example

​Staking precompile

​Reserve balance precompile

​Gas pricing differences

​Source code

Ethereum precompiles

Cryptographic and hashing

Arithmetic and utility

Elliptic curve alt_bn128

KZG commitment

BLS12-381

P256 signature verification

Input and output

Solidity example

Staking precompile

Reserve balance precompile

Gas pricing differences

Source code