ZK Analysis: The True Cost of ZK Verification

How much does it cost to verify a zero-knowledge proof on-chain? And, what does it mean exactly?

In this blog post we are going to have a look at the real cost of verifying proofs on some popular chains, and we will compare it to zkVerify to show the practical savings.

One Step Back: ZKPs

Succinct probabilistic proving systems are a class of schemes that allow one party (the Prover) to convince another party (the Verifier) that the result obtained by performing a certain computation on some input is correct, in a faster way than asking the Verifier to re-perform the same computation and check correctness by herself. The term “succinct” refers exactly to this efficiency property: on one side, the effort required by the Prover to convince the Verifier is “not much more” than performing the computation; on the other hand, the effort required by the verifier to check this proof is “much less” than performing the computation.

These proving systems can be interactive (where Prover and Verifier engage in a multi-round communication protocol) or non-interactive (where the Prover just sends a single message to the Verifier). In the latter case, succinctness also implies that the size of this message (the proof) is “much smaller” than the size of a full description of input and circuit performing the computation. SNARKs and STARKs are the two most known examples of non-interactive succinct probabilistic proving system families.

Zero-Knowledge (ZK), instead, is a property related to the privacy of the inputs of the computation: in a zero-knowledge proving system, the Prover can convince the verifier that the output of a given computation on some secret input is correct, without having to reveal the input to the Verifier. Zero-knowledge proof systems are generally abbreviated as simply ZKP.

Zero-knowledge and succinct non-interactive proving systems (such as zkSNARKs and zkSTARKs) are important building blocks for Web3 applications, due to their properties of efficiency and privacy. Groth16 is one of the most famous and most widely used practical schemes in this space, due to the extremely short proof size (120–300 bytes) and extremely fast, constant verification time (a few ms).

Why verification on-chain?

It is worth highlighting the fact that, in succinct ZKP systems, verifying a proof is usually very fast and cheap: the whole scheme has been designed to make this easy. While the proof generation can be quite taxing in terms of power and can take up to a couple of minutes of intensive computing, the verification of a proof can usually be done in a few ms on modest hardware. So, why are we concerned about the cost of verification at all?

The reason is that, even if verification is fast and cheap, there is a big difference on whether it is performed off-chain (e.g. on a user’s computer, by a web service, etc), or on-chain (by a smart contract). In fact, it is a relatively common use case to have a smart contract perform an action depending on whether a received proof is valid or not. In order to do so, the smart contract has to perform the verification using the chain’s logic, and this can get rapidly expensive, because the smart contract must request fees in order to provide an incentive to the network to perform this verification. Computation on a blockchain VM is expensive, and even a relatively fast and easy task can have a non-negligible cost.

We created zkVerify to solve this problem. Instead of having smart contracts verify proofs on their native chain, they can outsource the verification process to the dedicated zkVerify chain using appropriate bridges. The zkVerify chain cuts the verification cost by being extremely specialized in proof verification only, using aggregation techniques to further reduce the cost.

A Comparison

For this comparison we look at on-chain typical verification costs of the popular Groth16 proofs on zkVerify and on 5 other chains: Ethereum, BNB Chain, Avalanche, Arbitrum, and Optimism. The first three are L1, the other two are L2.

We look at precompile costs for the BN254 curve, for which all these networks provide built-in instructions for curve pairing computation.

The gas cost for verifying Groth16 is dominated by the cost for performing pairing operations (constant), plus a variable cost per additional public input of the circuit, and another fixed cost representing the EVM execution overhead. Let’s analyse all these costs separately.

According to EIP-1108 [1], the cost for pairing check is 34,000 * k + 45,000 gas, where k is the number of pairings (4 in our case [2]). This sums up to 181,000 gas.
The EVM execution overhead is composed of an ETH base transfer fee of 21,000 gas, plus calldata costs and EVM “scaffolding” opcodes.
The calldata cost is the cost for loading data in the contract call, fixed at 16 gas/byte. A Groth16 proof on BN254 has a fixed size of 256 bytes, for a total of 4,096 gas.
The “scaffolding” is the cost for the logic that prepares the data and calls the precompile instructions of the verifying contract. This requires a series of EVM instructions (CALL, PUSH, STORE< ISZERO, RETURN, etc) for a total of ~1'600 gas.

This sums up to ~207,700 gas of fixed cost.

For each additional public input to the circuit, we have to add 7'160 gas [4]. Let’s consider simple circuits with only 2 public inputs.

This leads to a total verification cost of ~220'000 gas.

Given the gas cost, for L1 chains we must multiply this by the gas price (in Gwei) for each chain, which depends on the congestion of the network and is very volatile. Then divide this number by 1,000,000,000 and multiply it by the current market price of the related coin.

Let’s consider an average priority transaction fee. For the month of October 2025 we had a rough average of:

Ethereum [5]: ~2 Gwei

BNB Chain [6]: ~2.5 Gwei

Avalanche [7]: ~25 Gwei

For L2 chains (Arbitrum, Optimism), instead, the computation is more complex. The L2 gas cost is lower (and tracked in ETH since these chains are roll-up to Ethereum):

Arbitrum [8]: ~0.05 Gwei

Optimism [9]: ~0.01 Gwei

but we also have to add the cost to post the proof data (256 bytes) to Ethereum in an EIP-4844 “blob”. The blob price per byte is regulated by the blob market [10] which, considering it has been introduced relatively recently, is currently unsaturated, and fees are very low: for the 256 bytes of a Groth16 proof we are looking at ~0.004 USD for Arbitrum and less than 0.001 USD for Optimism.

Current token prices are:

ETH: 3,073.75 USD*

BNB: 899.18 USD*

AVAX: 14.08 USD*

*Prices shown as of December 3, 2025

Summing up, we have:

Computation on zkVerify is more difficult because proofs are batched, but let’s just look at the zkVerify blockchain explorer [11].

A typical Groth16 settlement transaction [12] uses a fee like 0.021 VFY. At a current price of 0.03261 USD*, that makes it just slightly less than 0.0007 USD*. That is well under one-tenth of a cent.

*Prices shown as of December 3, 2025

Conclusion

As we have seen, verifying ZK proofs on-chain can be expensive. zkVerify makes it incredibly cheap for smart contracts to verify proofs, reducing verification cost to less than 1/100 of the cost on Ethereum, and beating even popular L2 chains in most scenarios.