ZK Rollup Prover Economics: Proof Generation Costs and Decentralised Prover Markets
ZK rollup provers generate the zero-knowledge validity proofs that allow L2 transactions to be verified on Ethereum without re-executing each transaction. Proof generation is computationally intensive and currently dominated by centralised provers operated by L2 teams — but decentralised prover markets (Gevulot, Nil Foundation, RISC Zero Bonsai) are emerging to create competitive, permissionless proof generation networks that reduce centralisation risk and proof costs.
What ZK Provers Do and Why They Matter
ZK rollups derive their security from zero-knowledge validity proofs — cryptographic proofs that verify the correctness of a batch of L2 transactions without requiring Ethereum validators to re-execute each transaction individually. When a ZK rollup submits a state update to Ethereum, it includes a validity proof that any Ethereum node can verify in milliseconds, confirming that all L2 transactions in the batch were executed correctly. This is the fundamental technological breakthrough that makes ZK rollups both scalable (batching thousands of transactions into one on-chain proof) and secure (Ethereum's consensus verifies correctness through the proof).
The prover is the computational entity that generates these validity proofs. Unlike transaction execution (which is fast and cheap), proof generation is computationally intensive — it requires solving complex cryptographic problems that are by design hard to compute but easy to verify. The economics of proof generation — who generates proofs, what it costs, and who pays — are central to ZK rollup sustainability and decentralisation.
The Proof Generation Computational Challenge
Current ZK proof systems (PLONK, Groth16, STARKs, and their variants) require significant computational resources to prove the execution of each transaction. Generating a proof for a batch of EVM transactions involves: (1) Trace generation — recording every CPU-level operation executed during the transactions. (2) Arithmetisation — converting the execution trace into polynomial constraints. (3) Polynomial commitment — cryptographic commitments to these polynomials. (4) Proof generation — the computationally expensive step where the prover demonstrates knowledge of a valid witness satisfying all constraints.
The current cost: generating a ZK proof for a batch of Ethereum-equivalent transactions costs approximately $0.001–$0.01 per transaction in compute costs on high-performance GPUs or FPGAs — already competitive with optimistic rollup verification costs at scale. However, proof generation latency (the time to generate a proof for a batch) is currently 1–20 minutes depending on batch size, hardware, and the specific ZK proof system — a constraint for applications requiring near-instant finality.
ZK proof generation is essentially a specialised computation market — the more competition among provers and the more hardware investment, the lower the cost and latency. This creates a compelling economic argument for decentralising the prover role: a competitive market of provers will drive down proof generation costs faster than any centralised operator's optimisation efforts.
The Centralised Prover Problem
Every major ZK rollup in production today — zkSync Era, StarkNet, Polygon zkEVM, Scroll, Linea — operates with a centralised prover: a single entity (the development team) that generates all validity proofs. This centralisation creates risks analogous to the centralised sequencer problem:
Liveness risk: If the centralised prover goes offline, no new state proofs can be submitted to L1 — the rollup cannot achieve L1 finality even if transactions continue to be sequenced. Users' transactions are processed but not finalised until the prover recovers.
Economic risk: If proof generation costs exceed the revenue from L2 transaction fees, the development team must subsidise proof generation indefinitely — an unsustainable arrangement as the L2 scales or if development funding runs out.
Censorship risk: A centralised prover could choose to exclude or delay proofs for specific transaction batches — though this is a weaker censorship vector than sequencer censorship since proof generation is downstream of sequencing.
The solution: decentralised prover networks where any operator can generate and submit validity proofs, competing for proof fees — the same logic as decentralised sequencer networks for eliminating sequencer centralisation risk.
Decentralised Prover Market Projects
Gevulot: A decentralised computation network designed specifically for proof generation — a blockchain where "provers" compete to generate proofs for any ZK rollup that integrates with the network. Gevulot uses a verification auction model: rollups post proof requests with a fee; registered provers compete to generate the proof first; the first valid proof submitted earns the fee. This creates a competitive market that should drive proof costs toward the marginal cost of computation.
RISC Zero Bonsai: RISC Zero has developed a ZK virtual machine (RISC-V based) and a proof generation service ("Bonsai") that allows any computation to be proved using RISC Zero's zkVM. Bonsai provides proving-as-a-service with a public API, allowing applications and rollups to offload proof generation to the Bonsai network. RISC Zero's proving technology can also be used by decentralised prover networks as the underlying proof generation engine.
Nil Foundation's Proof Market: A marketplace specifically for ZK proof trading — applications request proofs with defined specifications and prices; provers compete to fulfil requests. The Nil Proof Market is designed to be proof-system agnostic, supporting multiple ZK proof systems simultaneously.
Succinct Labs SP1: An open-source zkVM that makes proof generation accessible enough for any developer to generate proofs for arbitrary Rust programs — reducing the specialised expertise barrier for proof generation and enabling a broader prover market.
Hardware Acceleration: GPUs, FPGAs, and ASICs
The economics of ZK proof generation are dominated by hardware costs. Current proof generation runs primarily on GPUs (NVIDIA A100/H100 series), which provide good parallelism for the polynomial arithmetic underlying ZK proofs. FPGAs (field-programmable gate arrays) offer 3–10× performance improvement over GPUs for specific ZK proof systems. ASICs (application-specific integrated circuits) — custom silicon designed specifically for ZK proof generation — promise 100–1000× improvement over GPUs, potentially reducing proof costs by 2–3 orders of magnitude.
Multiple companies are developing ZK ASIC hardware: Fabric Cryptography, Cysic, and several semiconductor firms have announced ZK acceleration chips. As this hardware matures and deploys at scale, proof generation costs are expected to fall dramatically — making ZK rollups economically dominant over optimistic rollups for most use cases (no challenge period, lower long-term costs at scale).
Summary
ZK rollup prover economics sit at the intersection of cryptography, hardware engineering, and market design. Current centralised provers create security and liveness risks that decentralised prover markets are actively addressing. The economic trajectory — driven by hardware acceleration (FPGAs, eventually ASICs) and competitive prover markets — points toward dramatically lower proof costs and latencies over the next 3–5 years. For developers evaluating ZK rollup infrastructure and investors assessing ZK project moats, understanding the prover economics layer — who generates proofs, at what cost, and with what decentralisation guarantees — is increasingly important context for the L2 landscape.