# Zero Knowledge Proofs on Ethereum

<style>
body { overflow: hidden; }
body > .ui-infobar, body > .ui-toc, body > .ui-affix-toc { display: none!important; }
</style>

by [Jackie](https://x.com/agaperste) and [Shumo](https://x.com/shumochu)

> TL;DR: In this report, we present **the first quantitative analysis** of zero knowledge proof supply chain on Ethereum layer-1. We uses onchain zero knowledge proof verification activities as a lens to look at how zero knowledge proof changes the landscape of both applications and infrastructures on Ethereum.
> - zero knowledge proof gas cost dune dashboard: https://dune.com/nebra/zero-knowledge-proof-verification-cost-ethereum

## Why and How Zero Knowledge Proofs are used on Ethereum

Zero knowledge proofs allow arbitrary computation being verified with a small cryptographic proof, and with privacy guarantee. There are generally two ways applications/infrasctures using zero knowledge proofs:

- Majorly using its **zero-knowledge property** for preserving privacy
- Majorly using it for **verifiable computation and scaling**


In all these cases, zero knowledge proofs are generated from a combined user specific data and public available onchain data, and then are verified onchain so some further business logic can be carried, for example, token transfer and reach finality of a rollup.

From the proof data-flow point of view, when zero knowledge proofs are used for privacy preserving apps, the proof generation needs to happen on the client side, since otherwise sensitive user information such as their private key would be leaked. In these applications, user controlled clients, either browsers or apps running on their mobile phones submit proofs to blockchains directly.

Example of privacy preserving apps:
- zk based identity solutions such as [Worldcoin](https://worldcoin.org/)
- privacy preserving financial applications such as [tornado.cash](https://github.com/tornadocash) and [railgun](https://railgun.org)

When zero knowledge proofs are used for verifiable computation as scaling, the proof generation usually doesn't requires user sensitive data. As a result, the proof generation can be **delegated** on much powerful servers or on the public cloud. Some of the scaling solutions leverages extensive GPU accelerations to improve the throughput and latency of the proof generation.

Example of scaling solutions:
- zkRollups such as [zkSync](https://zksync.io/), [Polygon zkEVM](https://polygon.technology/polygon-zkevm), [Scroll](https://scroll.io/), [Starkware](https://starkware.co/), [Linea](https://linea.build/)
- zkCoprocessors such as [Succinct](https://succinct.xyz/), [RISC Zero](https://www.risczero.com/), [Axiom](https://axiom.xyz/), [Brevis](https://brevis.network/), [Lagrange](https://www.lagrange.dev/)

## Methodology

We implemenets queries over [Dune](https://dune.com/) indexed data of Ethereum to get the ZKP verification gas spendings. These spendings are majorly from calling the following precompiles:

| EVM Precompile | Name | Description | Minimal Gas Cost |
| -------------- |------| ----------- | ---------------- |
| `0x05` | `modexp`| modulo exponentiation | 200 |
| `0x06`|`ecAdd` | point addition on BN254 | 150 |
| `0x07`|`ecMul` | scalar multiplication on BN254 | 6,000 |
| `0x08`| `ecPairing` | pairing on BN254 | 45,000 |

If you want to check and/or contribute to the dashboard, please view the source/submit PR to: https://github.com/NebraZKP/ZKPVerification

## Zero Knowledge Proofs on Ethereum

### Overall Data
Out of the 10 projects we surveyed, almost $50M have been spent on verifying ZK proofs to date.

ZKSync Era, Scoll, and Linea as the three rollup infrastructure projects have consumed the most gas as well as submitted the most proofs to Ethereum mainnet. While Scroll only makes up 30% of the total cost overall among the 10 projects, it actually consists more than 70% of the gas used in the last 30 days -- indicating the quick growth Scroll is currently experiencing.

<iframe src="https://dune.com/embeds/3919405/6589144/"></iframe>


### Time Series
As you can see, since early 2020, with Tornado.Cash leading the way, there has been very steady adoption of ZKP technology on Ethereum. While OFAC sanction made a real dent in the adoption of the technology, the sector has been experiencing real come back and strong growth since early 2023. This is especially apparent as you see the monthly gas spent for ZKSync, Linea and Scroll.

<iframe width="100%" height="300" src="https://dune.com/embeds/3891266/6559655/"></iframe>

### Apps vs. Infra

The figures below show the number of ZKP transactions sent by applications versus infrastructure. Before August 2022, the majority of ZKP verifications were issued by applications. Since then, infrastructure transactions have taken a lion's share.

<iframe width="100%" height="300" src="https://dune.com/embeds/3924786/6598361/"></iframe>

To explore the data further, let's examine the application that submits the most ZKP verification transactions: tornado.cash.


We observe a significant drop in transaction volume since August 2022, correlating with the [OFAC tornado.cash sanction](https://home.treasury.gov/news/press-releases/jy0916).

On the other hand, general-purpose zkRollups have generated a significant number of proofs since March 2023, aligned with the major general-purpose zk L2s launch timeline:

- March 2023: zkSync Era/Polygon zkEVM mainnet launch
- July 2023: Linea mainnet launch
- October 2023: Scroll mainnet launch


### Technological evolution of zkRollups

Another trend is that zkRollups spend less and less gas for verifying ZKP onchain after major protocol upgrades, takeing zkSync as an example:


Two recent major protocol upgrades:
- March 2024, zkSync Era Blob update
- June 2024, zkSync Era shared bridge update

causes good savings on ZKP verification gas spendings.

Similar trend can be observed from Linea as well.