# Groth16 Verification Gas cost

## Analytical:
TLDR: For $\ell$ public inputs, on-chain G16 verification costs $\approx (181 + 6\times\ell)$ kgas

### Estimation:
Circuit with $$ \mathsf{vk} = (P = \alpha \cdot g, Q = \beta \cdot h, \{S_j\}_{j=0,\ldots \ell -1}, h, D = \delta \cdot h )$$
Proof $\pi = (A, B, C) \in \mathbb{G}_1 \times \mathbb{G}_2 \times \mathbb{G}_1$ and public inputs $\vec x = (x_0, \ldots x_{\ell-1}) \in \mathbb{F}_r^\ell$

$\mathsf{G16.Verify(\pi, \vec x, \mathsf{vk})} \in \{0,1\}$ is computed using:
- On-curve + in subgroup point checks: (gas cost omitted for now)
- 1 MSM of size $\ell$: public input term $F = \sum_{j=0}^{\ell-1} x_j \cdot S_j$
- Pairing check (4 Miller loops, 1 final exp.): $$e(A,B) \stackrel{?}{=} e(P,Q) e(F, h)e(C, D)$$

In terms of [gas fees](https://www.evm.codes/precompiled) that's
- $6,150 \times \ell$ (MSM) + $34,000 \times 4 + 45,000$ (Pairing) $\approx 181 + 6\ell$ kgas, thanks to [EIP 1108](https://eips.ethereum.org/EIPS/eip-1108)
- So 3 public inputs $\approx$ 200k gas
- Assuming 20gwei/gas, $2000/ETH that's about $8 to verify a proof that has 3 public inputs, and about $0.25 per additional public input.

TODO: The actual cost will be somewhat higher due to checking curve points. I don't think it's more than 10% higher but we should check against some actual smart contracts

## Empirical:
TODO