AZIP-33: Raise the GSE Proof-of-Possession Gas Cap to 300k

[spalladino]

Summary

This AZIP proposes raising the GSE proof-of-possession gas cap (proofOfPossessionGasLimit) from 250,000 to 300,000 with one governance action, included in the v6 upgrade payload. The GSE verifies each new validator's BLS proof of possession when the entry queue is flushed, inside a call capped at this value. If a valid key's verification does not fit, the deposit is refunded and the validator is not admitted.

Motivation

The cost of verification varies by key. BN254Lib.hashToPoint is a rejection-sampling loop, and each attempt that lands below the field modulus takes a square root with the modexp precompile. The fixed part (about 131k gas, mostly the 113k pairing) did not change with Osaka, but EIP-7883 repriced each square-root call in this loop from 1,338 to 4,016 gas. The 250k cap was sized before Osaka and was not revisited when Osaka activated, so the share of honestly generated keys that no longer fit rose about 150 times.

Example: public test key sk = 57193 (95 attempts, 18 sqrt calls) uses 214,891 gas under Prague pricing and 263,095 under Osaka pricing. It registered fine before Osaka and is rejected at 250k today.

Before and after

Share of honest keys whose minimum stipend exceeds the cap, summed over the exact joint distribution of attempts and sqrt calls (P(x < p) = 0.189030554816 per attempt, sqrt success 1/2), using the fitted conservative cost model:

Pricing	Cap	Honest proofs that fail	1 in	Per 1,000 registrations	Per 10,000 registrations
Prague (before Osaka)	250,000	0.0000237%	4,219,373	0.00024	0.0024
Osaka (today)	250,000	0.0035%	28,559	0.035	0.35
Osaka (proposed)	300,000	0.0000403%	2,484,286	0.00040	0.0040

Why 300k

300k cuts honest over-cap keys about 87-fold, back to the same order as before Osaka. The only cost is that a deposit whose verification genuinely fails can use up to 50k more gas in the flush transaction. 500k (9.6e-15) or 1M (5.1e-33) lower the rate further, but double or quadruple that per-entry worst case for negligible benefit. The loop is unbounded, so no cap fits every key; key tooling screens keys before registration.

Governance action

GSE.setProofOfPossessionGasLimit(300_000) on the mainnet GSE 0xa92ecFD0E70c9cd5E5cd76c50Af0F7Da93567a4f. The GSE is shared, so the new cap applies to all rollup instances that use it from execution onward. No contract code changes.

Implementation

• feat(l1): raise the GSE proof-of-possession gas cap to 300k in the v6 payload aztec-packages#25598 adds the action as the last step of the v6 upgrade payload (feat(l1): v6 rollup upgrade deploy script, payload and runbook aztec-packages#25496).
• test(l1-contracts): measure BN254 proof-of-possession gas against the GSE cap aztec-packages#25600 holds the measurements, cost model and calibration vectors.

What reviewers should check

• The cost model and the before/after rates (AZIP Motivation section, and the fixture in #25600).
• That 300k is the right trade-off against the larger per-entry bound for failing deposits.
• That the action is correctly placed in the v6 payload and cannot lower the cap (#25598).
• AZIP numbering: 33 is the next number after the open AZIP-31 and AZIP-32 PRs; editors may reassign it.