now lenstra writes great papers and is always very clear about time bounds. if the discrete log computation is done within a prime finite field F_q, the lenstra/schoof method factors q - 1 and precomputes quadratic residues for each factor. this precomputation is the exponential part (in runtime and in memory).
so lenstra cracked the discrete log shell once with the q -1 factorization, but nobody has done any better in the past 50 years as far as i can tell. ECC is prone to the exact same attack, since ECC is literally just obfuscated finite field arithmetic