The pairing friendly elliptic curve BN254 was previously used by ZCash (Section 5.4.9.1) and is currently the only curve with precompiled contracts on Ethereum for elliptic curve addition, scalar multiplication, and pairings (EIP 196, 197). Due to these precompiles, BN254 is the most practical choice of a pairing friendly curve to use for verifying on-chain zkSNARKs using proof schemes such as Groth16 and PlonK.
While the number of bits of security of BN254 dropped from 128 to around 100 after new algorithms of Kim-Barbulescu, due to the Ethereum precompiles BN254 is still the most practical choice of a pairing friendly curve to use for on-chain zkSNARK verification using proof schemes such as Groth16 and PlonK.
I have found that information around BN254 is hard to find (due in part to the multiple names, see below), so the purpose of this document is to gather all information relevant to developers/researchers using this curve in practice in one place. This document is of course inspired by the existence of BLS12-381 For The Rest Of Us.
To add to the confusion around BN254, it is colloquially referred to by several different names such as:
BN128 (128 previously referred to the bits of security) or
alt_bn_128