Skip to content
FrostFrost

VERIFY_MLDSA44

Frost post-quantum Signature verification

Verify an ML-DSA-44 (FIPS 204) post-quantum signature.

Address0x0000000000000000000000000000000000000015
NameVERIFY_MLDSA44
Minimum gas10,500
Input3764 bytes (exact)
Output32 bytes, always
Available sinceOsaka (Frost)

Input

msg32 B
signature2420 B
publicKey1312 B
OffsetLengthFieldDescription
032msgThe message. For a frame transaction this is the 32-byte sig-hash.
322420signatureStandard FIPS 204 ML-DSA-44 signature encoding.
24521312publicKeyStandard FIPS 204 ML-DSA-44 public key encoding.

Output

A 32-byte word: 1 if the signature is valid, 0 otherwise.

Gas

10,500 (flat, regardless of input)

Priced at ecrecover throughput parity on validator-class hardware, the same method as 0x14. Measured 116.3 µs per verify, giving parity at 10.4k, rounded up to 10,500 for margin. CONSENSUS-CRITICAL: changing this price requires a fresh chain.

Failure behaviour

  • Returns the 32-byte zero word — never empty data, and never an error — on an invalid signature, a non-canonical public key, or any input length other than the exact expected size.
  • Input is not right-padded.
  • Gas is charged in full on every call.

Notes

  • ML-DSA-44 is the cheaper parameter set: smaller keys and signatures, and about 35% less gas than ML-DSA-65.
  • Apple CryptoKit does not support ML-DSA-44. If you need Secure Enclave custody, use ML-DSA-65 at 0x14.
  • Same empty-context pure ML-DSA semantics as 0x14, and the same assurance stack.

Calling it

Precompiles have no ABI and no function selector: the input is raw bytes at the exact offsets above. Call with staticcall.

// VERIFY_MLDSA44 at 0x15
(bool ok, bytes memory out) = address(0x15).staticcall(input);
require(ok, "VERIFY_MLDSA44 reverted");