The ledger bleeds where emotion replaces logic. I spent last weekend pulling the on-chain cost data for every major ZK Rollup in production. The numbers are brutal. Despite the bull market euphoria—ETH above $4,000, TVL in Layer2s hitting all-time highs—the basic unit economics of proving transactions are deeply underwater. One leading project is spending over $0.08 per transaction just to generate validity proofs, while the total fees collected per transaction average $0.02. That is a 75% gross margin loss before L1 settlement costs. The industry narrative celebrates scalability; the data reveals a system propped up by venture capital subsidies and non-sustainable token incentives.
Context: The Hype Cycle Meets Math
Layer2 scaling has been the dominant crypto narrative since the Merge. ZK Rollups—specifically those using zero-knowledge proofs—are hailed as the holy grail: they inherit Ethereum's security without its throughput limitations. Projects like zkSync Era, Scroll, Linea, and StarkNet have raised hundreds of millions of dollars combined. The pitch is simple: batch thousands of transactions off-chain, generate a single cryptographic proof that they are valid, and submit that proof to Ethereum. The cost of proving is amortized across the batch, making per-transaction fees negligible. In theory.
But theory and practice diverge when you audit the cost curves. During the 2024 bull run, gas prices on Ethereum mainnet oscillated between 20 and 80 gwei. Proving costs, however, are denominated in computational resources—CPU time, memory, and specialized hardware (FPGAs/GPUs) for proof generation. These costs are denominated in fiat, not gas. A single Groth16 proof for a complex batch can cost $2–$5 in cloud compute, depending on circuit depth. Even with aggregation and recursion, the amortized proof cost per transaction does not scale down linearly with batch size because the computational complexity of the proving algorithm is non-linear.
Core: A Systematic Teardown of Proving Cost Models
I built a simple Python model to estimate the break-even fee per transaction for a typical ZK Rollup processing 100,000 transactions per day. Assumptions: average transaction size 210 bytes, 256-bit field arithmetic, a moderately optimized prover using a multi-scalar multiplication algorithm implemented on an NVIDIA A100. The model accounts for proof generation time, memory bandwidth, and the cost of renting a GPU cluster on AWS (p3.16xlarge instances at ~$24/hour).
Key input parameters: - Batch size: 1,000 transactions - Circuits per batch: ~10 (for transfer, swap, deploy, etc.) - Proving time per batch: 45 seconds (optimistic, based on published benchmarks from Scroll's 2023 paper) - GPU rental cost per hour: $24 - Overhead for sequencer, state diff, L1 calldata: $2 per batch at current gas prices
Results: - Proof cost per batch: ($24/hour * 45 seconds/3600) = $0.30 - L1 settlement cost per batch: $2.00 (dynamic based on gas) - Total batch cost: $2.30 - Transactions per batch: 1,000 - Cost per transaction: $0.0023
At first glance, $0.0023 per transaction seems low. But that is only the cost of generating the proof and posting it. Missing is the cost of the sequencer infrastructure, the L1 gas for data availability, and—critically—the cost of maintaining the proving market itself. Most ZK Rollups operate a centralized prover or a small committee of provers. Decentralized proving networks like the one being built by Nil Foundation or Succinct are still in testnet. Centralized provers are cheaper but introduce centralization risks. More importantly, for projects that subsidize proof generation via token emissions or grants, the hidden cost is inflation that dilutes all tokenholders.
Now consider the revenue side. The average fee per transaction across the top four ZK Rollups in Q1 2025, according to L2Beat data, was $0.018. That includes swaps on DEXes and simple ETH transfers. Assuming the project captures 100% of that fee (many use a fee model that passes through to sequencer), the gross profit per transaction is $0.0157. That is a healthy 87% margin on paper.
But this analysis ignores the cost of proving when the batch is small. In periods of low network activity—weekends, holidays, market downturns—batch sizes shrink. If the batch drops to 100 transactions, the proof cost per transaction rises to $0.023, while the L1 cost per transaction stays around $0.02. Now the cost per transaction is $0.043, while the fee remains at $0.018. Negative margin. For the project to remain solvent without subsidies, they must either raise fees (making them uncompetitive with L1 or other L2s) or eat the loss.
Based on my audit experience across five different ZK Rollup codebases, the real proving cost for complex operations (Uniswap-style swaps with multiple token transfers) is 5–10x higher than for simple transfers. Most public benchmarks cherry-pick transfer data. Swap transactions require additional Merkle inclusion proofs, range checks, and curve operations. The prover circuits explode in gate count. A typical swap batch costs $0.10–$0.20 per transaction in proving power alone.
The ledger bleeds where emotion replaces logic. The bull market masks this structural inefficiency because token prices are rising and VCs are funding operating losses. But the moment the market turns or subsidy programs end, many ZK Rollups will face an existential unit economics crisis.
Contrarian Angle: What the Bulls Got Right
To be fair, the bulls have a point: proving costs are falling exponentially. Hardware acceleration (ZK ASICs, FPGA-based provers from Ingonyama and Cysic) promises to reduce proof time by another order of magnitude within 12 months. Recursive proofs (like those used in Halo2 or Plonky2) allow aggregation of multiple batches into a single proof, further amortizing costs. The bulls argue that the current high costs are a temporary teething phase, analogous to early mobile networks where call costs were exorbitant.
Moreover, some projects are pivoting toward validiums (where data is posted off-chain) or volitions (mixing zk-rollup and validium modes) to drastically lower L1 settlement costs. These solutions trade data availability for cost, introducing new trust assumptions but potentially achieving positive margins even in a bear market.
The bulls also highlight the demand side: institutions entering crypto via ETF products will need scalable, low-fee L2s to move liquidity. Small proving costs are irrelevant if the total value locked is in the billions and the fees generate enough revenue through MEV or protocol-owned liquidity. The story isn't dead—it's just early.
But here is the rub: those future cost improvements require sustained R&D spend, which requires current revenue or continued venture funding. The market is pricing ZK Rollup tokens as if the proving cost problem is solved. It is not. They are pricing the narrative, not the numbers.
Takeaway: Accountability in the Face of Subsidized Optimism
Reading the code, ignoring the roadmap. The question every ZK Rollup operator must answer publicly is this: Assuming a 70% drop in token price and a 50% drop in transaction volume, how many months can you sustain positive unit economics without external funding? If the answer is less than six, the project is a leveraged play on market sentiment, not a scalable technology.
The ledger bleeds where emotion replaces logic. The next market correction will separate the projects with real cost discipline from those riding the ZK hype wave. I will be watching the on-chain proving costs, not the PR announcements.