# Gas costs

Last updated

Last updated

Let's walk through the factors determining the end-to-end gas costs for a ZK app using NEBRA UPA. There are three on-chain steps that can consume gas:

Submitting proofs

on-chain (

**~13-100k gas per proof- depends on submission size**)off-chain (

**0 gas per proof**)

Verifying the aggregated proof (

**~18k gas per proof**)Querying the verification result (

**~22k gas per proof or per submission**)

The total per-proof gas cost, in both the on-chain submission (UPA v1) and off-chain submission (UPA v2) case is shown below:

Submission Size | Per-Proof Gas w/o Aggregation | Per-Proof Gas (v1) | Per-Proof Gas (v2) |
---|---|---|---|

Summing up these costs, we find that in total:

Applications submitting their proofs on-chain can save as much as

**197k gas**(~80%) per proof.Applications submitting their proofs off-chain can save upwards of

**210k gas**(~85%) per proof.

You can estimate your application's gas savings using our gas calculator at** ****gas.nebra.one**. For simplicity we show gas estimates for an application with four public inputs, but the actual costs for each step will vary a bit depending on the number of public inputs per proof.

Step 1: Proof Submissions

NEBRA UPA collects **submissions** of one or more proofs and places them in a queue to be aggregated. Note that UPA does not aggregate submission-by-submission. Instead, **aggregated batches** are chosen independently of the way the proofs were submitted.

Applications will have two options for proof submissions: on-chain and off-chain. On-chain submissions cost gas in exchange for censorship-resistance (an aggregator that skips verifying a valid proof can be slashed). Off-chain submissions have no gas cost, but offer weaker censorship resistance.

The current UPA release (v1.3) supports on-chain submission. Off-chain submission will be available soon.

Cost of on-chain submission

Due to per-transaction storage costs, using a whole Ethereum transaction to submit a single proof is relatively expensive. Instead, we recommend that apps take advantage of **multi-proof submissions**.

The contracts currently deployed to the Sepolia testnet are initial implementations with large scope for gas optimization, but they serve to illustrate the approximate cost model. Currently, the fixed cost per submission is about **100k gas**. The marginal cost of each additional proof in a submission is about **10k gas** (for processing the additional proof and public input data).

Therefore the per-proof gas cost for an on-chain submission of $M$ proofs is approximately:

$100000/M + 10000$

The table below shows the measured cost of submissions of different sizes.

Cost of off-chain submission

Off-chain submissions have no associated gas cost, but a weaker censorship resistance mechanism: In response to a submission, the aggregator sends back a confirmation that they will aggregate the proof before a certain deadline. If this aggregator misses this deadline then they are subject to slashing.

Step 2: Verifying the aggregated proof

The current version of NEBRA UPA aggregates proofs into a Halo2-KZG proof. The cost of verifying such a proof in isolation is about **350k gas**, and is roughly independent of batch size. In addition, the UPA contract emits an event and updates its storage to mark each application proof in the batch as verified. This incurs a marginal per-proof cost of about **7k gas**.

Therefore the per-proof gas cost for verifying one batch of $N$ proofs and storing the result is approximately:

$350000/N + 7000$

The current configuration of NEBRA UPA sets the batch size to $N=32$. With this batch size the aggregated verification cost comes out to **~18k gas** per proof (Etherscan).

Step 3: Query of the verification result

Once a proof has been verified by the UPA contract, the app contract may query the UPA contract to confirm that the associated public inputs are valid. This typically looks like:

The gas cost of this external contract call is about **22k gas** per proof (assuming four public inputs).

Applications may also query the verification status of an entire submission as follows:

This costs about the same amount of gas as calling `isProofVerified`

.

Calculation of end-to-end gas savings

Without UPA

The total cost for an app to verify an individual Groth16 proof is about **250-270k gas**, which can be broken down into:

Submitting and verifying the proof (

**~250k gas**)Retrieving the verification result

from an external contract (

**~10-20k gas**)from within the app contract (

**0 gas**)

**Using UPA with on-chain submission**

With UPA, assuming submissions of size $M$ and proof aggregations of size $N$, the total end-to-end per-proof gas cost **with on-chain submissions** comes out to about:

$100000/M + 350000/N + 39000$

Concretely, with submissions of $M=32$ proofs and aggregations of $N=32$ proofs, this per-proof gas cost comes out to

$100000/32 + 350000/32 + 39000 \approx 53000$

which represents a savings of about **197k gas per proof** (~80%).

**Using UPA with off-chain submission**

The end-to-end gas cost **with off-chain submissions** will be approximately:

$350000/N + 29000$

With the current UPA configuration of $N=32$, the per-proof cost comes out to

$350000/32 + 29000 \approx 40000$

which represents a savings of about **210k gas per proof** (~85%).

Submission Batch Size | Per-proof Submission Gas |
---|---|

1

250k

150k

40k

2

250k

100k

40k

4

250k

75k

40k

8

250k

62.5k

40k

16

250k

56k

40k

32

250k

53k

40k

4

33,127

8

22,013

16

16,451

32

13,679