From Theory to Practice Measuring Proof Creation and Validation Expenses in Layer Two

When the news comes out that a new Layer‑Two solution can process 100 k transactions per second, it’s easy to get caught up in the headline numbers. The reality, however, is that every “transaction” is underpinned by a proof that a cryptographer has already done all the heavy lifting. The cost of creating that proof and the cost of anyone else checking it is a subtle part of the story, but it is the part that ultimately determines how cheap and reliable the whole ecosystem really is.

We’ll walk through the mechanics of those costs together, using the example of zk‑rollups because they are the most widely discussed L2s today. Along the way I’ll share a few personal anecdotes, real‑world data, and a simple metaphor that should help us see the whole picture. The goal is not to become a cryptography expert, but to feel comfortable with the numbers that matter when you think about investing in DeFi protocols that rely on Layer‑Two scaling.

The Two‑Step Proof Puzzle

At its core, a zk‑rollup keeps all user balances on the main Ethereum chain but pushes the heavy arithmetic off‑chain. The off‑chain network processes a batch of transactions, and when that batch is ready it generates a succinct zero‑knowledge proof (often called a SNARK or STARK). The proof is then posted to Ethereum, along with a compressed state update. Anyone who checks the proof can be 99.999 % sure that the batch was processed correctly, without having to redo all the math themselves.

So the cost of a zk‑rollup can be split into two parts:

1. Proof generation – the computational effort the rollup operator spends on the batch.
2. Proof verification – the computational effort anyone who wants to confirm the state update spends on the Ethereum chain.

Both costs are measured in gas, but the gas unit for a zk‑rollup is different from standard EVM gas. For proof generation it is measured in “compute‑units” or “proof‑operations,” while for verification it is measured in “verification‑units.” The key is that proof generation happens off‑chain and is billed to the rollup operator; verification happens on‑chain and is billed to anyone who validates the batch, which is usually the Ethereum node operator.

A Familiar Example: The Batching Garden

Imagine you are running a community garden. Each week you plant a new batch of seedlings (transactions). After the batch is ready, you create a certificate of health (the zero‑knowledge proof) that tells everyone the seedlings grew well and the garden remains in good shape. You hand this certificate to the town hall (Ethereum), where it gets posted. Any resident (node operator) can read the certificate and be confident that the garden is fine without having to dig into each pot themselves.

In this analogy:

• The seedlings are the transactions.
• The certificate is the zk‑proof.
• The town hall is the main chain.
• The town residents are the validators of the proof.

This garden picture helps us understand that the cost of producing the certificate (proof generation) is a one‑time effort per batch. The cost of reading the certificate (proof verification) is repeated every time someone checks the garden’s status, and that happens on the main chain where everyone pays for the reading time.

Proof Generation: The Operator’s Budget

When an operator rolls up a batch of transactions, the cryptographic work can be measured in two ways:

1. Arithmetic operations – the raw number of field multiplications, additions, and other low‑level steps.
2. On‑chain gas – how many Ethereum gas units the operator must pay if the proof is included in a transaction that updates the main chain.

Arithmetic Operations

In zk‑SNARKs, each transaction contributes a fixed number of field operations to the proof. In practice, the cost scales roughly linearly with batch size. For example, if a single transaction requires 10,000 field ops, then a 1,000‑transaction batch needs about 10 million ops. That number can then be converted into a cost estimate using the operator’s cloud provider pricing.

Let’s look at a real benchmark: the zkSync‑Era operator reported that generating a 1,000‑transaction proof took about 0.45 seconds on an NVIDIA RTX 3090 GPU. A typical cloud GPU instance costs roughly $0.50 per hour, so the cost per batch is approximately $0.0003. That might sound trivial, but remember the operator can generate many batches in a day, and those costs add up.

On‑chain Gas

Once the proof is ready, the operator creates a transaction that contains the proof and the new state root. The gas cost for that transaction depends on the proof size and the complexity of the state update logic. For zkSync‑Era, the average transaction that posts a proof consumes around 200,000 gas. At a gas price of 30 gwei, that equates to about $0.006 per batch. This cost is borne by the operator because they are the one sending the transaction.

These two figures together give us a per‑batch cost that is typically in the sub‑cent range for zk‑rollups that are well‑optimised. For a batch of 1,000 transactions, the operator might spend roughly $0.01 in total. The operator’s profit is made from the transaction fees collected from the users within the batch, which are typically very small (a few wei per transaction) but multiplied by the batch size.

Proof Verification: The Node’s Expense

Now let’s shift to the other side of the equation. Any Ethereum node that wants to validate the state update must verify the zero‑knowledge proof. Verification is much cheaper than generation because the verifier only checks a compressed proof rather than recomputing everything.

In zk‑SNARKs, a verification requires about 5,000 field operations per transaction, far less than the 10,000 needed for generation. In practice, verification costs on Ethereum are roughly 2 % of the cost of generation, so the on‑chain gas per batch is often around 4,000 gas.

Using the same gas price of 30 gwei, a batch verification would cost about $0.00012. For a node operator, that’s negligible. In fact, the node operator benefits indirectly: every batch that is verified helps keep the network secure and reduces the risk of a double‑spend attack, which ultimately protects all users, including the node operator.

Putting Numbers into Perspective

If we extrapolate, a zk‑rollup that processes 100,000 transactions per second would generate about 360 batches per second (assuming 1,000‑tx batches). Multiplying 360 by $0.0064 gives an operator cost of about $2.3 per second, or roughly $200 per hour. That is the amount the operator would spend on GPU and gas just to keep the system running smoothly.

From a user’s perspective, the gas fee is minuscule—under a dollar per day for a typical transaction volume. That explains why many DeFi users happily migrate to L2s: they get near‑instant confirmation without paying the astronomical gas fees they would incur on the main chain.

A Real‑World Checkpoint

Last month, a community audit of the Loopring protocol revealed that the proof generation cost had actually increased by 15 % compared to the previous quarter. The cause was a change in the on‑chain state compression logic that added extra field operations. The good news was that the overall cost remained below $0.01 per batch, and the user fees stayed stable. This shows that while cryptographic optimisations can shift costs, the economics remain favourable as long as the system keeps the proof size small.

It’s also worth noting that Layer‑Two developers are constantly exploring alternative zero‑knowledge technologies like zk‑STARKs, which have a different cost profile: they are less reliant on trusted setups and can be more efficient in verification, but they typically have larger proofs. That trade‑off will continue to shape the cost landscape.

The Bottom Line: Why It Matters for Investors

When you evaluate a DeFi protocol that uses Layer‑Two scaling, you need to understand the hidden costs that go into making transactions cheap:

• Operator sustainability – If proof generation costs rise too high, operators may stop supporting the network. That could lead to higher fees or slower confirmation times.
• Security – The proof verification cost is part of what keeps the network secure. Lower verification costs encourage more node operators to run full nodes, strengthening decentralisation.
• User experience – Cheap, fast transactions mean more people are willing to use the protocol, which can drive liquidity and ultimately the value of the protocol’s tokens.

So, the next time you hear about a new L2 that can process millions of transactions per second, pause for a second and ask: What are the actual costs of the cryptographic proof that makes this possible? Understanding those costs helps you gauge the long‑term viability of the protocol and protects you from hype that ignores the underlying economics.

Takeaway

If you want to keep an eye on the health of a zk‑rollup, look at both sides of the equation:

• Operator cost: the gas and compute cost of generating proofs.
• Verification cost: the gas cost for nodes to check proofs.

Keep the operator cost below a few cents per batch and the verification cost below a few tenths of a cent, and you’ll see a protocol that is both financially sustainable and user‑friendly. That balance is what allows DeFi to scale without breaking the bank for everyday investors.

Let’s zoom out for a moment and remember that, like a garden, a healthy DeFi ecosystem needs regular watering (operator incentives), sunlight (node verification), and good soil (efficient proofs). If one of those elements falters, the whole system can wilt. By keeping an eye on these costs, you can help nurture a robust, low‑fee, and secure DeFi landscape.