Groth16 Verification Gas cost

Analytical:

TLDR: For

$\ell$ public inputs, on-chain G16 verification costs

$\approx (181+6\times \ell )$ kgas

Estimation:

Circuit with

$$\mathsf{vk}=(P=\alpha \cdot g,Q=\beta \cdot h,\{S_j{\}}_{j=0,\dots \ell -1},h,D=\delta \cdot h)$$
Proof

$\pi =(A,B,C)\in {\mathbb{G}}_1\times {\mathbb{G}}_2\times {\mathbb{G}}_1$ and public inputs

$\overrightarrow{x}=(x_0,\dots x_{\ell -1})\in {\mathbb{F}}_r^{\ell }$

$\mathsf{G}\mathsf{16.}\mathsf{Verify}\mathsf{(}\pi \mathsf{,}\overrightarrow{\mathsf{x}}\mathsf{,}\mathsf{vk}\mathsf{)}\in \{0,1\}$ is computed using:

• On-curve + in subgroup point checks: (gas cost omitted for now)
• 1 MSM of size
  $\ell$: public input term
  $F=\sum _{j=0}^{\ell -1}{x}_j\cdot S_j$
• Pairing check (4 Miller loops, 1 final exp.):
  $$e(A,B)\stackrel{?}{=}e(P,Q)e(F,h)e(C,D)$$

In terms of gas fees that's

• $6,150\times \ell$ (MSM) +
  $34,000\times 4+45,000$ (Pairing)
  $\approx 181+6\ell$ kgas, thanks to EIP 1108
• So 3 public inputs
  $\approx$ 200k gas
• Assuming 20gwei/gas, $2000/ETH that's about $8 to verify a proof that has 3 public inputs, and about $0.25 per additional public input.

TODO: The actual cost will be somewhat higher due to checking curve points. I don't think it's more than 10% higher but we should check against some actual smart contracts

Empirical:

TODO