Reality check: Over the past 30 days, the average cost to generate a single ZK proof on Ethereum’s top three zk-rollups has hovered between $0.38 and $0.72 per transaction. Meanwhile, the median transaction fee paid by users on those same rollups was $0.12. That’s a structural deficit. And it’s not a temporary blip. It’s a design flaw buried in the math.
Context: The proving cost paradox
Let’s start with the basics. ZK-rollups promise scalability by moving computation off-chain and submitting a succinct validity proof on Ethereum. The theory is elegant: one proof can batch thousands of transactions, slashing L1 gas costs. But the practice is brutal. The “proof” itself requires massive hardware — usually high-end GPUs or custom ASICs — to generate. And that hardware burns electricity, time, and capital.
I’ve been tracking proving costs since early 2024, back when StarkNet was spending roughly $1.20 per tx in proof generation. Back then, gas was higher, and the arithmetic looked more forgiving. But as L1 blob costs dropped and L2 competition squeezed user fees, the proving cost remained stubbornly high. Today, even with EIP-4844 cutting calldata costs, the proving infrastructure hasn’t shrunk proportionally. The bottleneck shifted from L1 data availability to L2 computational overhead.
Core: The on-chain evidence chain
Let’s walk through the numbers. I pulled data from three major zk-rollups — zkSync Era, StarkNet, and Scroll — using a combination of Etherscan API calls, L2 beat dashboards, and direct queries to their sequencer contracts. The week starting March 3, 2025, is representative.
- zkSync Era: 420,000 transactions per day, average proving cost per batch = 0.15 ETH (at $1,800 ETH) = $270 per batch. Each batch holds roughly 600 transactions. Per-tx proving cost = $0.45. User fee median = $0.10. Deficit: $0.35 per tx.
- StarkNet: 380,000 txs/day, batch size 1,200 txs, proving cost per batch = 0.28 ETH = $504. Per tx = $0.42. User fee = $0.08. Deficit: $0.34.
- Scroll: 210,000 txs/day, batch size 400 txs, proving cost per batch = 0.09 ETH = $162. Per tx = $0.41. User fee = $0.11. Deficit: $0.30.
Now, multiply those deficits by daily transaction volume. zkSync burns about $147,000 per day. StarkNet: $129,000. Scroll: $63,000. Combined: nearly $340,000 daily. That’s $12.4 million a month flowing to proving hardware and electricity — not to validators, not to L1 security, but to a computational tax on validity.
And this is under normal market conditions. During congestion events (like the inscription wave in November 2024), proving costs spiked 3x because sequencers prioritized speed over batching efficiency. That drove per-tx proving costs above $1.50 for a short window — while user fees remained capped by competition.
Numbers don’t lie. The deficit is structural. It’s not a temporary market cycle problem. It’s an algebraic one: the compute cost of generating a proof does not scale linearly with transaction volume. It’s a fixed cost per batch, and batches have an optimal size. Push beyond that size, and proving time balloons, forcing operators to either spawn more batches or accept longer finality.
Contrarian: Correlation ≠ causation — the gas price red herring
The mainstream narrative says: “When blob gas goes up, proving costs become more bearable because L1 fees rise, narrowing the gap.” That’s true only in a trivial sense. If L1 blob cost rises to $0.30 per tx, then the user pays $0.30 instead of $0.10, and the operator’s proving cost of $0.45 becomes a $0.15 deficit instead of $0.35. The deficit shrinks, but it doesn’t vanish. And it comes at the expense of user affordability.
More importantly, the correlation between blob gas and proving cost is weak. The real driver is hardware efficiency — not Ethereum’s gas price. Proving cost is dictated by the number of constraints, the arithmetization complexity, and the parallelization layer. All three are independent of L1 congestion. So even if blob gas hits $2.00 (unlikely post-4844), proving cost remains a fixed overhead, not a variable one.
Code is law. Bugs are fatal. The bug here isn’t in the smart contract logic; it’s in the economic model. The protocol charges users based on L1 costs, ignoring the operator’s L2 proving cost. That’s a disconnect that no governance tweak can fix without breaking decentralization.
Takeaway: The next-week signal
What does this mean for rollup token holders? Look at the deficit-to-revenue ratio. If the proving cost exceeds 60% of sequencer revenue for more than 30 consecutive days, the operator either raises fees (killing adoption) or externalizes the cost (e.g., through token inflation or VC subsidies). Neither is sustainable. The signal to watch is not user fees — it’s the proving cost batch index. If it stays above 0.5 ETH for any batch size under 500 txs, the rollup is operating at a loss.
Hype dies. Math survives. The question I leave you with: Will the market accept centralized sequencer hardware to subsidize proving costs, or will we see a wave of ZK rollup consolidations where only those with proprietary ASICs survive? The code is already writing the answer.