Skip to main content
Metal extends the Ethereum Osaka precompile set with proof verification, privacy primitives, Travel Rule verification, and Ed25519 verification. Contracts call these addresses with STATICCALL or CALL using the binary inputs below.

​
Address map

Related addresses: The Osaka precompile at 0x100 provides RIP-7212 P-256 signature verification, including WebAuthn use cases.

​
Byte-order conventions

Unless a field says otherwise:
  • fixed-width integers in custom wires are big-endian;
  • field elements and curve coordinates occupy 32-byte words; and
  • boolean results use the 32-byte ABI encoding of 0 or 1.
Inputs must match the documented byte layout. A wrapper contract may expose an ABI function that constructs this layout.

​
UltraHonk verifier

Applications normally call CircuitRegistry.verify(bytes) at 0xF0. The registry resolves the verification key and constructs this 0xF2 input:
The supported backend tag is UltraHonk 0x02. keyLen includes the backend byte. The verifier requires keccak256(backend || verificationKey) == circuitId and returns 1 for a valid proof. Base gas before Metal’s CPU multiplier is:

​
Hash and curve primitives

0xF3 returns the BLAKE2s-256 digest of the complete input. For 0xF4, each input and the result is one 32-byte field element. 0xF5 accepts and returns exactly four such elements. 0xF6 uses a BN254 G2 point encoded as four 32-byte coordinate limbs and returns four limbs. Grumpkin points at 0xF7 and 0xF8 use x || y and return the same 64-byte form.

​
Travel Rule verification

0xF9 verifies the Travel Rule record commitment and co-signature from a virtual asset service provider (VASP). Its input is:
The output is the recovered VASP signing address left-padded to 32 bytes. Invalid structure or signature returns 32 zero bytes. The calling policy contract must construct and check the payment-bound digest and authorize the recovered signer under its configured policy. The precompile does not inspect payment semantics or legal completeness of the committed fields. Base gas is 6,000 + 1,000 * fieldCount before the CPU multiplier.

​
Ed25519 verification

0xFB accepts:
It returns the 32-byte boolean encoding of the verification result. Base gas is 4,000 + 12 * ceil(messageBytes / 64) before the CPU multiplier.

​
CPU gas multiplier

Metal multiplies the base gas of CPU-heavy precompiles by 64. This applies to custom precompiles 0xF2 through 0xF9 and 0xFB. It also applies to these Osaka precompiles: SHA-256 at 0x02, RIPEMD-160 at 0x03, and identity at 0x04 retain their standard Osaka pricing.

​
Failure behavior

Every 32-byte field element passed to 0xF2 through 0xF8 must be canonical: below the modulus of its field. The precompiles never reduce a larger value. A non-canonical element is invalid input, so 0xF4 halts the call and the others return the output in this table. An out-of-gas precompile call fails like any other EVM call. Wrapper contracts must check the call status, output length, and returned value.