Proving Cost in ZK Rollups

A proving cost in ZK rollups is the hardware and computational expense required to generate a cryptographic validity proof that attests to the correctness of off-chain transactions. These costs are borne by provers and flow into user fees, making them a critical component of rollup economics.

How Proving Works in ZK Rollups

In a ZK rollup, a batch of transactions is bundled off-chain and executed in an optimized virtual machine. The prover then generates a succinct cryptographic proof—often measured in kilobytes or megabytes—that mathematically certifies the batch’s correctness without revealing transaction details. This proof is posted to the Ethereum mainnet (or another settlement layer), where a smart contract verifies it in constant or near-constant time.

The proving cost includes every hardware and energy expense incurred during this proof generation:

• CPU and GPU cycles to execute the computation
• Memory allocation to store intermediate values
• Network bandwidth to transmit the proof
• Electricity consumed by the hardware
• Depreciation of the proving infrastructure

Unlike a traditional computation, where you run it once and get the result, proof generation is a one-way process. You cannot reverse-engineer the witness data (the private transaction details) from the proof, but you can verify the proof itself quickly on-chain.

Circuit Complexity and the Hardware Arms Race

Proof generation cost scales with the complexity of the circuit—the logical blueprint that encodes the rollup’s rules. A more expressive circuit (supporting more operations, more complex smart contracts, larger batches) requires more computational steps and more memory to prove.

Most production ZK rollups use specialized hardware:

• GPU clusters for general-purpose proving (NVIDIA H100s are common)
• FPGAs (field-programmable gate arrays) for customized, highly optimized circuits
• ASICs (application-specific integrated circuits) for the largest-scale operations, offering 100x speedup over GPUs but requiring massive capital investment

A single proof can take anywhere from seconds to minutes to generate, depending on the circuit, batch size, and hardware. The largest batches (processing thousands of transactions per proof) can require provers to rent entire GPU clusters.

Batch Size and Per-Transaction Amortization

The genius of rollup economics is that proving cost is amortized across a batch. If generating a proof costs $1,000 in hardware and energy, but the batch contains 1,000 transactions, the per-transaction cost is $1. If the batch scales to 10,000 transactions, the cost per transaction drops to $0.10—even though the absolute proving cost may rise slightly.

This creates strong incentives for rollup operators to:

• Maximize batch size to spread costs over more users
• Compress transaction data to fit more operations in one proof
• Optimize circuit code to reduce CPU cycles per transaction

However, there are limits. Larger batches mean longer delays (users wait for the batch to fill before their transactions are proven and finalized), and the circuit complexity that enables more expressive transactions drives up proving cost in absolute terms.

Who Pays: Fee Recovery and Competitive Pressure

The rollup sequencer collects transaction fees from users and forwards a portion—or all of it—to the prover as compensation. Some rollups use a single entity as both sequencer and prover; others have independent provers competing to prove batches (permissionless proving networks).

In a competitive proving market, the prover’s profit margin is the difference between the fee they receive and their actual hardware and energy cost. If proving costs rise (due to more complex circuits or GPU price inflation), fees must rise too. If a rival rollup with a simpler circuit can prove transactions more cheaply, they can undercut fees and gain market share.

This is why ZK rollup developers obsess over proof speed and circuit optimization. Faster proofs mean cheaper proofs, which means lower fees and better user experience—critical advantages in a crowded rollup market.

Hardware Cost Inflation and Scalability

Proving cost is sensitive to global GPU availability and pricing. When AI training demand spikes (as it has since 2023), GPU prices rise and GPU availability tightens. Rollups with GPU-intensive proving can suddenly find their per-transaction cost increasing even if nothing on-chain changed.

This has motivated research into:

• Proof aggregation: Many smaller proofs are combined into one, reducing the number of on-chain verifications and gas cost
• Proof recursion: Proofs that verify other proofs, compressing the total proof size
• Lookup tables and custom gates: Circuit optimizations that reduce the number of operations needed
• Custom silicon: Building ASICs optimized for specific proof systems (Plonk, Halo2, STARK) to achieve orders-of-magnitude speedups

Real-World Impact on User Fees

Early ZK rollups like zkSync 2.0 and Starknet had proving costs of $10–$100 per transaction before optimization. As circuits improved and proving infrastructure scaled, costs dropped to $0.01–$0.50 per transaction. The end-user fee—what a trader pays to submit a swap—is this proving cost plus margin, data availability cost, and the sequencer’s operating expense.

A rollup cannot sustainably price transactions below the true cost of proving them. If the hardware cost is high, users pay high fees or the rollup runs at a loss. If the hardware cost is low, fees can be competitive and the rollup is economically sound.

Rollups with larger transaction volume can negotiate better GPU pricing, use more efficient custom hardware, or operate in regions with cheaper electricity—giving them a structural cost advantage and the ability to undercut rivals on fees.

See also