Skip to main content
Precompiles are contracts at predefined addresses that provide cryptographic and utility functions implemented natively rather than in EVM bytecode. They are callable like any other contract via CALL or STATICCALL. Monad supports all Ethereum precompiles as of the Fusaka fork (0x01 to 0x11), plus two additional precompiles:

​
Ethereum precompiles

​
Cryptographic and hashing

AddressNameGasDescription
0x01ecRecover6000ECDSA public key recovery
0x02sha25660 + 12 * word_sizeSHA-256 hash function
0x03ripemd160600 + 120 * word_sizeRIPEMD-160 hash function
0x09blake2frounds * 2BLAKE2 compression function F

​
Arithmetic and utility

AddressNameGasDescription
0x04identity15 + 3 * word_sizeReturns the input unchanged
0x05modexpsee evm.codesArbitrary-precision modular exponentiation

​
Elliptic curve alt_bn128

AddressNameGasDescription
0x06ecAdd300Point addition on alt_bn128
0x07ecMul30,000Scalar multiplication on alt_bn128
0x08ecPairing225,000Bilinear pairing check on alt_bn128

​
KZG commitment

AddressNameGasDescription
0x0apoint_eval200,000KZG commitment verification (EIP-4844)

​
BLS12-381

These precompiles provide operations on the BLS12-381 curve per EIP-2537.
AddressNameGasDescription
0x0bbls12_g1_add375Point addition in G1
0x0cbls12_g1_msmsee EIP-2537Multi-scalar multiplication in G1
0x0dbls12_g2_add600Point addition in G2
0x0ebls12_g2_msmsee EIP-2537Multi-scalar multiplication in G2
0x0fbls12_pairing_checksee EIP-2537Pairing check over (G1, G2) point pairs
0x10bls12_map_fp_to_g15500Map base field element to G1 point
0x11bls12_map_fp2_to_g223800Map extension field element to G2 point

​
P256 signature verification

Address 0x0100 verifies signatures on the secp256r1 (P256) elliptic curve per EIP-7951.
EIP-7951 supersedes RIP-7212. If you are migrating from a chain that uses RIP-7212 at 0x100, note that the address and interface are identical — only the EIP designation has changed.
The P256 curve is used by WebAuthn, Apple Secure Enclave, Android Keystore, and hardware security modules. With this precompile, you can verify passkey signatures on-chain, enabling biometric authentication flows for smart accounts without relying on off-chain signature verification.

​
Input and output

The precompile accepts exactly 160 bytes:
OffsetSizeParameterDescription
032 byteshashMessage hash
3232 bytesrSignature component r
6432 bytessSignature component s
9632 bytesqxPublic key x-coordinate
12832 bytesqyPublic key y-coordinate
All values are big-endian encoded as 256-bit unsigned integers. Returns:
  • 0x0000...0001 (32 bytes) on a valid signature
  • Empty bytes on an invalid signature or malformed input
Gas cost: 6900

​
Solidity example

address constant P256_VERIFY = address(0x0100);

function verifyP256Signature(
    bytes32 hash,
    uint256 r,
    uint256 s,
    uint256 qx,
    uint256 qy
) internal view returns (bool) {
    (bool success, bytes memory result) = P256_VERIFY.staticcall(
        abi.encodePacked(hash, r, s, qx, qy)
    );
    return success && result.length == 32 && abi.decode(result, (uint256)) == 1;
}
For passkey infrastructure and embedded wallet providers on Monad, see Embedded Wallets.

​
Staking precompile

Address 0x1000 provides the interface for validator delegation, undelegation, reward claims, and staking queries. Gas costs vary by function.

​
Gas pricing differences

A few precompiles (0x01, 0x06, 0x07, 0x08, 0x09, 0x0a) are repriced relative to Ethereum to reflect their relative costs in Monad’s execution environment. The gas values in the tables above reflect Monad’s pricing. See Opcode pricing for a comparison.

​
Source code

See the precompile implementation.