I have been tracking the economics of ZK proof generation since 2023, and the cost trajectory over the past two years has been nothing short of remarkable. What was once the single biggest argument against ZK rollups – “proving is too expensive” – is rapidly becoming irrelevant. But the details of how and why costs are dropping deserve deeper analysis than the headline “90% reduction” suggests.
The Cost Stack: Breaking Down What “Proving Cost” Actually Means
When people say ZK proving costs X dollars per transaction, they are collapsing several distinct cost components into a single number. Let me decompose this:
1. Compute cost (the dominant factor)
This is the raw cost of running the mathematical computation to generate a zero-knowledge proof. It depends on the size and complexity of the computation being proved, the proof system used (STARK, SNARK, or hybrid), and the hardware running the prover (CPU, GPU, FPGA, or ASIC).
In 2023, proving a batch of around 1,000 transactions on a zkEVM cost roughly $50-100 in compute, predominantly on CPU-based provers. Today, the same batch costs $2-10 on GPU-based provers and is projected to cost under $1 on upcoming FPGA and ASIC hardware.
2. Memory cost
ZK proving is memory-intensive. STARK provers in particular require large amounts of RAM to hold polynomial evaluations and Merkle tree states. A production STARK prover for a zkEVM typically needs 128-512 GB of RAM per proving instance. This is a meaningful infrastructure cost that does not get enough attention.
3. Proof aggregation overhead
Most production ZK rollups do not post one proof per batch. They aggregate multiple batch proofs into a single proof before posting to L1. This aggregation step has its own compute cost, but it dramatically reduces L1 verification gas costs by amortizing a single on-chain verification across many batches.
4. L1 verification gas cost
The cost of verifying the final proof on Ethereum L1. Post-Fusaka, this is roughly 200-300K gas for a SNARK proof, which at current gas prices translates to $0.50-2.00 per verification. Divided across the thousands of transactions in the aggregated proof, this is essentially negligible per transaction.
The Hardware Revolution
The most impactful driver of cost reduction has been the transition from CPU-based to GPU-based proving, with FPGA and ASIC solutions on the horizon.
GPU Proving (Current State of the Art)
Modern GPU provers exploit the massive parallelism of number theory transforms (NTTs) and multi-scalar multiplications (MSMs), which are the core operations in both SNARK and STARK proving. NVIDIA A100 and H100 GPUs can perform these operations 50-100x faster than high-end CPUs.
Key implementations include Icicle by Ingonyama, an open-source GPU acceleration library supporting multiple proof systems with 10-50x speedup over CPU. Both Polygon and zkSync have custom CUDA implementations optimized for their specific proof systems. Running an H100 instance on major cloud providers costs roughly $2-4 per hour. At current proving speeds, this translates to $0.005-0.02 per transaction.
FPGA Proving (Emerging)
FPGAs offer a middle ground between GPUs and ASICs: better energy efficiency than GPUs with more flexibility than ASICs. Companies like Cysic and Ulvetanna (now part of Fabric Cryptography) are developing FPGA-based proving solutions. They offer 5-10x better energy efficiency than GPUs and lower latency for time-critical operations. The main barrier is development complexity – FPGA development requires specialized hardware engineering skills that are even scarcer than ZK cryptography expertise.
ASIC Proving (12-18 Month Horizon)
Purpose-built ZK proving ASICs represent the theoretical floor for proving costs. Fabric Cryptography is building general-purpose ZK ASICs targeting both SNARK and STARK operations. Cysic is developing ZK-specific hardware with a roadmap from FPGA to ASIC. The challenge is the chicken-and-egg problem: proof systems are still evolving, and an ASIC designed for today’s system may be suboptimal for tomorrow’s.
The Economics at Scale
Here is where the analysis gets interesting. The total cost of running a ZK rollup has a significant fixed component and a variable component that scales sublinearly with transaction volume.
At low volume (1,000 TPS): proving costs roughly $0.01-0.02 per transaction, with L1 verification and infrastructure adding small amounts. Total comes to approximately $0.02-0.03.
At high volume (10,000 TPS): proving drops to $0.002-0.005 per transaction, bringing total costs to roughly $0.003-0.006.
Compare this to optimistic rollups at similar scale – sequencer operation plus L1 data posting comes to roughly $0.002-0.006 per transaction. The cost gap between ZK and optimistic rollups at high volume is essentially gone. And at high volume, the ZK rollup offers fundamentally better security and finality properties for a similar price.
The Flywheel Effect
What excites me most is the flywheel dynamic: cheaper proving enables more ZK applications, which drives hardware investment, which drives further cost reductions. We are in the early stages of a proving cost spiral that mirrors what happened with GPU computing in the deep learning era.
Fusaka’s upgrades accelerated this by reducing the on-chain verification bottleneck. Now that L1 verification is cheap, the focus shifts entirely to off-chain proving efficiency – and that is where hardware competition is fiercest.
Within two years, I expect ZK proving costs to be a rounding error in rollup operating expenses. The question will shift from “can we afford to prove?” to “can we afford not to?”
What are others seeing on the hardware side? Anyone running production provers who can share real-world cost data?
Sources: CoinGecko ZK proofs and rollups, Permatech ZK proofs in Web3 security 2026, Chainlink ZK proof projects overview