EIP-2098: Compact Signature Representation
ECDSA signatures on the secp256k1 curve consist of (r, s, v) where r and s are 32-byte field elements and v is the recovery byte (1 bit, but stored as a full byte for alignment reasons → 65 bytes total).
EIP-2098 packs v into the high bit of s: since secp256k1 enforces low-s canonicality (EIP-2 / EIP-2098 itself), the high bit of s is always 0, so it can carry the recovery bit. Result: 64-byte signatures instead of 65.
Why It Matters
- Smart contract storage and calldata cost reduction.
- Off-chain protocols that bundle many signatures (multi-sigs, DAOs) save 1.5%.
- Cleaner compatibility with EVM contracts that take
bytes32slot-aligned signatures.
Neo Equivalent
Neo signatures are 64 bytes natively. The verification curve is secp256r1 (NIST P-256, ECDSA), and the signature format is (r, s) directly — no recovery byte because Neo verification doesn't need to recover the public key from the signature (the public key is in the witness script).
Live on Neo TestNet
Both implementations are deployed on Neo N3 TestNet (network magic 894710606).
| Implementation | Contract Hash | Deploy Tx |
|---|---|---|
Solidity (neo-solc) | 0xd63ea34d63f0628c4cd413f58aa1c2623b1121d9 | (reused — see 0xd63ea34d63f0628c4cd413f58aa1c2623b1121d9) |
Neo C# (nccs) | 0xb2701b6d89a734b5a865a1ec6c247466391c4eee | (reused — see 0xb2701b6d89a734b5a865a1ec6c247466391c4eee) |
Cross-implementation invocations match on compactSize and legacySize; the C# port also exposes Neo's native 64-byte signature verifier. Source pairs under docs/standards-mirror/deployments/eip-2098/.
