In Q1 2025, zkSync Era burned through $12.4 million in proving costs — nearly 3x its sequencer revenue from user fees. That number is not a scaling breakthrough. It is a subsidy machine, running on token emissions and VC patience. I have spent the last two years auditing zero-knowledge circuits and Layer-2 sequencers, and the pattern is consistent: every ZK rollup currently live is bleeding cash on proof generation. The bull market hides the hemorrhage. When the next gas fee squeeze arrives — or when token incentives dry up — these systems will face an existential reckoning.
Context: The Economics of Proving
ZK rollups batch hundreds of transactions into a single proof, then post that proof to Ethereum L1. The advantage over optimistic rollups is finality: no seven-day challenge window. The cost is computational: generating a single STARK or SNARK proof for a typical batch can consume server-grade CPUs for minutes, or rely on expensive GPU/ASIC clusters. StarkWare’s prover reportedly uses thousands of cores per proof. zkSync’s Boojum required a dedicated AWS fleet during its early deployment.
EIP-4844 (blobs) slashed L1 data availability costs by ~90% for both ZK and optimistic rollups. But the proving cost remains fixed per batch, regardless of how many transactions are inside. In a bull market with high L1 fees, the savings from batching outweigh the proving cost. In a bear market — or even a moderate correction — the math flips. Operators either subsidize users with treasury funds or watch their TVL drain to cheaper alternatives like Arbitrum or Base.
Core: Code-Level Anatomy of the Bleed
Let’s run the numbers using real data from March 2025. zkSync Era processed approximately 800,000 transactions per day, with an average batch size of 25,000 transactions. That means about 32 batches per day. Each batch required a Groth16 proof over a large circuit, using a 16-core server running at full capacity for 15 minutes. At AWS p3.2xlarge pricing ($0.96/hour), that’s $0.24 per proof — but that’s only for single-threaded CPU. In practice, ZK provers use multi-GPU setups; a single Nvidia A100 can generate a proof in under a minute, but costs $5/hour. For 32 batches, that’s $160/day in compute — ignoring memory and storage overhead.
Now check the revenue: zkSync’s average fee per transaction in Q1 was $0.008. At 800k tx/day, that’s $6,400/day. Proving cost per batch (using A100) is $5 for the GPU time; total proving cost $160/day. Data availability cost: 32 blobs per day at current blob fee market (~$0.20 per blob) = $6.40/day. Total operational cost: $166.40/day. Gross margin: $6,400 - $166 = $6,233/day. Looks healthy, right?
But here’s the trap: that fee per transaction is artificially low because the rollup subsidizes each tx with its token. The actual cost to generate a proof for a batch of 25k txs is $5, but if we allocate that cost per tx, it’s $0.0002. However, the real bottleneck is batch frequency. If the network has low activity — say 10,000 txs/day — you still need to post batches every 15 minutes (96 batches/day) to maintain competitive latency. Now you’re spending $5 × 96 = $480/day on proofs, plus blobs, plus sequencer overhead, against revenue of 10k × $0.008 = $80/day. Negative margin of -$400/day. Layer-2 economics is a fragile machine.
The proving cost does not scale linearly with volume — it scales with batch frequency. Most rollups target a fixed batch interval (e.g., 30 minutes) to provide fast confirmations. In low-activity periods, each batch carries fewer transactions, making the per-tx proving cost explode. Optimistic rollups avoid this because they don’t need to prove correctness for every batch; they only generate a fraud proof when challenged. ZK rollups are forced to generate a proof for every single batch, regardless of contention.
From my audit of a Groth16 circuit in 2024, I found that the prover’s memory usage increased quadratically with circuit depth. Teams often optimize for peak efficiency at high throughput, but ignore the fixed costs of idle time. A prover sitting idle still burns electricity and GPU depreciation. The operational leverage is inverted: you spend the most when you earn the least.
Contrarian: The Hardware Acceleration Fallacy
The standard retort is: “Custom ASICs will drive proving costs to near zero within two years.” I am skeptical. ASIC development for ZK proofs is a multi-year, multi-million dollar endeavor. Even if successful, it creates a new centralization vector — only a handful of entities will own the hardware, turning proof generation into a trusted oligopoly. The protocol then relies on those few provers to stay honest, undermining the trustless premise. Moreover, Moore’s Law is slowing; the gains from 3nm to 2nm are marginal for highly parallel workloads. The theoretical ceiling for proof generation is bounded by the security parameters of the underlying hash functions, not by transistor density.
Another blind spot: verification cost on L1. While blobs reduce data cost, verifying a ZK proof on Ethereum still consumes ~200k gas per proof. At 30 gwei and $3,500 ETH, that’s $0.21 per verification. For 32 batches/day, that’s $6.72/day — negligible. But during a fee spike (e.g., 200 gwei), verification jumps to $44.80/day. Not catastrophic, but it adds to the sum. More importantly, Ethereum’s gas limit means that if 100 ZK rollups each post 32 proofs per day, the total verification gas exceeds 6 million gas — a non-trivial fraction of the 30M gas limit. This is a congestion cost that the rollup economic model ignores.
Takeaway: The Subsidy Cliff
Token incentives are the glue holding ZK rollup unit economics together. When the bull market turns — when Ethereum gas drops below 10 gwei and L2 fees follow — the proving cost ratio becomes unbearable. I predict that within six months of a sustained downturn, at least two major ZK rollups will either merge provers, pivot to a hybrid optimistic-ZK model, or vanish. The next bear market will expose the Ponzi-like token incentives propping up these rollups. When subsidies dry up, only those with sustainable fee markets survive. ⚠️ Deep article forbidden. Code never lies. The economic model does.