EIP-8224 introduces a new EIP-2718 transaction type (0x08) - the counterfactual transaction - for protocol-native shielded gas funding using ZK proofs against canonical fee-note contracts.
The problem
A fresh EOA with no ETH can’t pay gas. Receiving ETH from any source creates a traceable on-chain link - defeating the privacy goal. This is the bootstrapping problem that remains even after EIP-8223 (Contract Payer Transaction / sponsored transactions).
How it works
A user deposits ETH into a canonical fee-note contract instance (recognized by runtime code hash, not a fixed address), receiving a private Poseidon commitment
Later, from a fresh EOA, they submit a counterfactual transaction carrying an fflonk ZK proof (over BN254) that they own an unspent fee note sufficient to cover gas
The protocol verifies the proof (no EVM execution needed - bounded cryptographic computation + fixed storage reads), consumes the fee note’s nullifier, settles gas, and sends any leftover ETH to a designated gas_refund_recipient
The transaction body executes normally - it can call any contract (privacy pool withdrawal, account setup, etc.)
Key design properties
Code-hash recognition - fee-note contracts are recognized by EXTCODEHASH, not a fixed predeploy address. Multiple instances can coexist. The transaction names its instance via fee_note_contract, and the proof binds to that address
fflonk over BN254 - universal setup (reuses existing powers-of-tau), 2-pair pairing verification, ~176K gas proof verification cost. No circuit-specific trusted setup ceremony
Append-only accepted roots - deposits add roots that are never revoked. Proofs against older roots remain valid forever, preventing censorship-based griefing
Arbitrary note values - no fixed denomination tiers. Deposit any ETH amount; the circuit proves fee_denomination == note_value
chain_id bound in proof - defense-in-depth against cross-chain replay (8 public inputs total)
Explicit intrinsic gas - proof verification, state access/mutation, and settlement transfer logs are itemized following EIP-2780 methodology with EIP-7904 precompile costs
One-shot bootstrap - used once to fund a smart account and register it in the Contract Payer Transaction payer registry; all subsequent txs use cheap sponsored transactions
Composable - the data field can target any contract; the fee note only handles gas authorization
Bounded ETH exit - unused fee-note value emerges as public ETH at gas_refund_recipient, doubling as an account bootstrap mechanism
Mempool-safe - validation is bounded cryptographic computation + a canonical code-hash check + fixed storage reads, no EVM execution