Gas and cost model
Note: Verification and Kernel-routing costs are measured on a local Nitro devnode where L1 data costs are zero. L1 data costs are projected from Arbitrum mainnet pricing. Treat the L1 numbers as estimates until re-measured on Sepolia and then mainnet.
Per-transaction costs
| Operation | Gas | Notes |
|---|---|---|
| ML-DSA-65 verification (Stylus) | 374,000 | Core cryptographic operation |
| Full PQ UserOp (ETH transfer) | 751,312 | End-to-end including Kernel routing |
| Equivalent ECDSA UserOp | 202,816 | Baseline for comparison |
| PQ overhead vs ECDSA | 3.7× | Total UserOp ratio |
About half of the PQ UserOp cost is cryptographic verification; the other half is the ERC-4337 / ERC-7579 / Kernel plumbing that any non-trivial validator pays.
Cost projection on Arbitrum mainnet
| Component | Estimate | Notes |
|---|---|---|
| L2 execution (~751K gas) | ~$0.04 | At 0.05 gwei L2 gas price |
| L1 data posting (~5.5 KB calldata) | $2–8 | Dominant cost; varies with L1 gas price |
| Total per PQ transaction | $2–8 | Within the $10 design target |
L1 data is the dominant cost driver. A 3,309-byte ML-DSA signature plus a 1,952-byte public key in calldata is roughly two orders of magnitude more expensive than the L2 execution cost.
One-time setup costs
| Operation | Gas | Notes |
|---|---|---|
| Install PQ validator module | ~1,570,000 | Kernel.installModule(TYPE_VALIDATOR, pqValidator, initData) |
| Grant selector access | ~346,000 | Kernel.grantAccess(pqValidationId, execute.selector, true) |
Both setup operations are ECDSA-signed UserOps from the account's root validator. PQ security takes effect for transactions submitted after this setup.
Data sizes
| Property | ECDSA | ML-DSA-65 | Ratio |
|---|---|---|---|
| Signature | 65 B | 3,309 B | 51× |
| Public key | 64 B | 1,952 B | 31× |
| WASM binary (gzipped) | — | 7.8 KB | Stylus limit: 24 KB compressed |
The calldata weight of every PQ UserOp is roughly 5–6 KB once the signature, public key, gas fields, and the rest of the UserOp envelope are included.
Measured breakdown
From end-to-end traces on a local Nitro devnode:
Component Gas (measured)
──────────────────────────────────────────────────────
ML-DSA verification (Stylus) 374,000
Kernel routing + module dispatch ~377,000
──────────────────────────────────── ──────────────────
PQ UserOp total (ETH transfer) 751,312
For comparison:
ECDSA UserOp (same operation) 202,816
Product implications
- Average users on Arbitrum mainnet will see $2–8 per PQ transaction at today's L1 gas prices. Acceptable for moving assets; unacceptable for high-frequency interactions.
- Hot wallets / day-to-day spending are better served by a non-root ECDSA validator with PQ as a gate on selected high-value selectors.
- Vault / cold storage is a natural fit — low transaction count, high asset value per transaction.
- Future cost trajectory is driven mostly by L1 calldata pricing (EIP-4844 blobs and follow-ons). Stylus execution cost is already near a floor for this workload.
Cost-reduction levers not yet applied
- Calldata compression — at least 2× to be had on the signature side with bit-packed encodings, at the cost of an off-chain decompression step.
- Rollup-level UserOp batching — a shared verifier could amortize plumbing costs across many users.
- Blob calldata — once EIP-4844 blob calldata is consumable from L2s and the bundler ecosystem supports it for UserOps, PQ signatures can ride in blob space at a fraction of current L1 cost.