# Groth16 Verification Gas cost
## Analytical:
TLDR: For $\ell$ public inputs, on-chain G16 verification costs $\approx (181 + 6\times\ell)$ kgas
### Estimation:
Circuit with $$ \mathsf{vk} = (P = \alpha \cdot g, Q = \beta \cdot h, \{S_j\}_{j=0,\ldots \ell -1}, h, D = \delta \cdot h )$$
Proof $\pi = (A, B, C) \in \mathbb{G}_1 \times \mathbb{G}_2 \times \mathbb{G}_1$ and public inputs $\vec x = (x_0, \ldots x_{\ell-1}) \in \mathbb{F}_r^\ell$
$\mathsf{G16.Verify(\pi, \vec x, \mathsf{vk})} \in \{0,1\}$ is computed using:
- On-curve + in subgroup point checks: (gas cost omitted for now)
- 1 MSM of size $\ell$: public input term $F = \sum_{j=0}^{\ell-1} x_j \cdot S_j$
- Pairing check (4 Miller loops, 1 final exp.): $$e(A,B) \stackrel{?}{=} e(P,Q) e(F, h)e(C, D)$$
In terms of [gas fees](https://www.evm.codes/precompiled) that's
- $6,150 \times \ell$ (MSM) + $34,000 \times 4 + 45,000$ (Pairing) $\approx 181 + 6\ell$ kgas, thanks to [EIP 1108](https://eips.ethereum.org/EIPS/eip-1108)
- So 3 public inputs $\approx$ 200k gas
- Assuming 20gwei/gas, $2000/ETH that's about $8 to verify a proof that has 3 public inputs, and about $0.25 per additional public input.
TODO: The actual cost will be somewhat higher due to checking curve points. I don't think it's more than 10% higher but we should check against some actual smart contracts
## Empirical:
TODO

or

By clicking below, you agree to our terms of service.

Sign in via Facebook
Sign in via Twitter
Sign in via GitHub
Sign in via Dropbox
Sign in with Wallet

Wallet
(
)

Connect another wallet
New to HackMD? Sign up