Documentation Index
Fetch the complete documentation index at: https://docs.monad.xyz/llms.txt
Use this file to discover all available pages before exploring further.
Precompiles are contracts at predefined addresses that provide cryptographic and utility functions
implemented natively rather than in EVM bytecode. They are callable like any other contract
via CALL or STATICCALL.
Monad supports all Ethereum precompiles as of the Fusaka fork (0x01 to 0x11), plus two
additional precompiles:
Ethereum precompiles
Cryptographic and hashing
| Address | Name | Gas | Description |
|---|
0x01 | ecRecover | 6000 | ECDSA public key recovery |
0x02 | sha256 | 60 + 12 * word_size | SHA-256 hash function |
0x03 | ripemd160 | 600 + 120 * word_size | RIPEMD-160 hash function |
0x09 | blake2f | rounds * 2 | BLAKE2 compression function F |
Arithmetic and utility
| Address | Name | Gas | Description |
|---|
0x04 | identity | 15 + 3 * word_size | Returns the input unchanged |
0x05 | modexp | see evm.codes | Arbitrary-precision modular exponentiation |
Elliptic curve alt_bn128
| Address | Name | Gas | Description |
|---|
0x06 | ecAdd | 300 | Point addition on alt_bn128 |
0x07 | ecMul | 30,000 | Scalar multiplication on alt_bn128 |
0x08 | ecPairing | 225,000 | Bilinear pairing check on alt_bn128 |
KZG commitment
| Address | Name | Gas | Description |
|---|
0x0a | point_eval | 200,000 | KZG commitment verification (EIP-4844) |
BLS12-381
These precompiles provide operations on the BLS12-381 curve per EIP-2537.
| Address | Name | Gas | Description |
|---|
0x0b | bls12_g1_add | 375 | Point addition in G1 |
0x0c | bls12_g1_msm | see EIP-2537 | Multi-scalar multiplication in G1 |
0x0d | bls12_g2_add | 600 | Point addition in G2 |
0x0e | bls12_g2_msm | see EIP-2537 | Multi-scalar multiplication in G2 |
0x0f | bls12_pairing_check | see EIP-2537 | Pairing check over (G1, G2) point pairs |
0x10 | bls12_map_fp_to_g1 | 5500 | Map base field element to G1 point |
0x11 | bls12_map_fp2_to_g2 | 23800 | Map extension field element to G2 point |
P256 signature verification
Address 0x0100 verifies signatures on the secp256r1 (P256) elliptic curve per
EIP-7951.
EIP-7951 supersedes RIP-7212.
If you are migrating from a chain that uses RIP-7212 at 0x100, note that the address and
interface are identical — only the EIP designation has changed. | Offset | Size | Parameter | Description |
|---|
| 0 | 32 bytes | hash | Message hash |
| 32 | 32 bytes | r | Signature component r |
| 64 | 32 bytes | s | Signature component s |
| 96 | 32 bytes | qx | Public key x-coordinate |
| 128 | 32 bytes | qy | Public key y-coordinate |
0x0000...0001 (32 bytes) on a valid signature- Empty bytes on an invalid signature or malformed input
Gas cost: 6900
Solidity example
address constant P256_VERIFY = address(0x0100);
function verifyP256Signature(
bytes32 hash,
uint256 r,
uint256 s,
uint256 qx,
uint256 qy
) internal view returns (bool) {
(bool success, bytes memory result) = P256_VERIFY.staticcall(
abi.encodePacked(hash, r, s, qx, qy)
);
return success && result.length == 32 && abi.decode(result, (uint256)) == 1;
}
Staking precompile
Address 0x1000 provides the interface for validator delegation, undelegation, reward claims,
and staking queries. Gas costs vary by function.
Gas pricing differences
A few precompiles (0x01, 0x06, 0x07, 0x08, 0x09, 0x0a) are repriced relative to
Ethereum to reflect their relative costs in Monad’s execution environment. The gas values in
the tables above reflect Monad’s pricing. See
Opcode pricing for a comparison.
Source code
See the precompile implementation.
