ZK Proof Gas Costs 2026: Which Proving System Is Cheapest?

The ZK Proving Landscape in 2026

Zero-knowledge proofs have moved from research papers to production infrastructure. Every major L2 rollup, privacy protocol, and identity system now depends on ZK proving systems — and the gas cost of verifying those proofs on Ethereum L1 directly impacts user fees and protocol economics.

But not all proving systems are equal. A Groth16 proof costs roughly 227,000 gas to verify on-chain. A direct STARK proof can run into the millions. And a new entrant called GLYPH-zk has demonstrated verification at just 29,450 gas — a 7.7x improvement over the incumbent.

For builders choosing a ZK stack, these numbers matter. They determine whether your users pay $0.02 or $2.00 in verification fees. They influence which L2 you deploy on and whether your privacy protocol is economically viable at scale. Here’s a data-driven breakdown of every major proving system’s on-chain costs as of July 2026.

Groth16: Still the Gold Standard for On-Chain Verification

Groth16 remains the most gas-efficient production proving system for on-chain verification. Its constant-sized proof (~192 bytes) and single-pairing-check verification model make it the default choice for most ZK rollups and privacy applications.

Key benchmarks for Groth16 on Ethereum L1 (BN254 curve):

• Single proof verification: ~220,000–230,000 gas
• Proof size: 192 bytes (constant, regardless of circuit complexity)
• Base team benchmark (SnarkJS): 347,665 gas for ECDSA verification circuit
• Gnark (with extra security features): 407,664 gas (+17% vs SnarkJS)
• Trusted setup required per circuit (a non-trivial operational cost)

Groth16’s trusted setup is its main weakness. Every circuit change requires a new multi-party computation ceremony, which adds coordination overhead and limits upgrade flexibility. For protocols that iterate frequently on their circuit logic, this is a meaningful operational burden.

That said, Groth16’s raw gas efficiency is hard to beat for production systems that can absorb the ceremony cost. With EIP-2537 (BLS12-381 precompiles) now live as part of the Fusaka upgrade, BN254 and BLS12-381 are roughly on par for verification costs — giving Groth16 implementations more curve flexibility than ever before.

GLYPH-zk: 7.7x Cheaper Without a Trusted Setup

The most surprising result in 2026 ZK benchmarks comes from GLYPH-zk, a novel transparent proof system that achieves verification at approximately 29,450 total transaction gas on Ethereum testnets — roughly 7.7x cheaper than Groth16’s 227,128 gas for the same number of public inputs.

GLYPH-zk’s key innovations:

• Completely transparent — no trusted setup required, ever
• Proof size: approximately 384 bytes (still compact)
• Verification gas: ~29,450 (Sepolia and Hoodi testnet measurements)
• No circuit-specific ceremony needed for upgrades or changes
• Open-source implementation available on GitHub

If these numbers hold in production, GLYPH-zk represents a step-change in ZK economics. A protocol that previously spent $50 per day on Groth16 verification could drop to roughly $6.50 — and eliminate the ongoing cost and coordination burden of trusted setup ceremonies.

However, GLYPH-zk is still new. It hasn’t undergone the same level of adversarial scrutiny as Groth16, which has been battle-tested across billions of dollars in TVL since 2016. Builders should watch closely but verify thoroughly before migrating production systems.

STARKs: Quantum-Ready but Gas-Heavy on L1

zk-STARKs offer two major advantages over SNARKs: quantum resistance and no trusted setup. The tradeoff is proof size — and therefore on-chain verification cost.

STARK verification benchmarks:

• Small circuit proof size: ~42 KB (vs Groth16’s 192 bytes)
• Large circuit proof size: up to 200 KB
• Direct L1 verification: ~1,000,000–2,500,000 gas (prohibitively expensive for most use cases)
• WHIR verification (new approach, May 2026): ~4.3M–5.6M gas on EVM
• Off-chain verification: fast and efficient, making STARKs ideal for L2s that batch-verify

In practice, STARKs are almost never verified directly on L1. They’re either wrapped into a SNARK-friendly proof (STARK-to-SNARK recursion), verified inside a rollup’s own proving system, or used in validity-proof constructions where the heavy verification happens off-chain.

For builders, this means STARKs shine in scenarios where quantum resistance or transparent setup is non-negotiable and the verification model doesn’t require direct L1 settlement. If your use case demands on-chain proof verification, the gas math pushes you toward SNARK-based systems or recursive wrapping.

Batching Proofs: The Real Gas Saver

Individual proof gas costs tell only part of the story. In production systems — especially rollups processing thousands of transactions per block — proof batching and aggregation deliver the largest absolute savings.

According to benchmarks from 7BlockLabs (January 2026), batching Groth16 proofs produces dramatic results:

• Naive per-proof verification: ~220,000–235,000 gas per proof
• On-chain batch verification: ~98.5% savings vs naive approach
• Batch verification is ~93–94% cheaper than recursive aggregation
• Cutting one public input from a proof saves ~6,000–8,000 gas on both BN254 and BLS12-381

These numbers explain why every major ZK rollup uses some form of proof aggregation. A rollup processing 1,000 transactions per block doesn’t verify 1,000 individual proofs — it aggregates them into a single batched proof, often recursively, and verifies that one proof on L1.

The Tokamak zkEVM team demonstrated this in practice, reducing their verifier’s G1 exponentiations from 40 to 31 through polynomial aggregation and scalar factorization — cutting total verification gas from 857,200 to 748,450, a 12.7% improvement.

Choosing the Right Proving System for Your dApp

With so many options, choosing a proving system can feel overwhelming. Here’s a practical decision framework based on what you’re building:

For general-purpose dApps and rollups where gas efficiency matters most: Groth16 remains the production default. Its 220K gas per proof and decade-long track record make it the safest choice. If you can absorb the trusted setup ceremony, it’s hard to beat.

For privacy protocols or applications prioritizing transparency: GLYPH-zk’s 29.5K gas with no trusted setup is compelling, but wait for more security audits and production deployments before committing. The 7.7x gas improvement is real, but so is the risk of unproven cryptography.

For systems requiring quantum resistance: STARKs are your only viable option today. Accept that you’ll need recursive wrapping or off-chain verification. Direct L1 STARK verification at 1M+ gas is not economically practical for most applications.

For high-throughput rollups: Proof batching matters more than individual proof cost. Your engineering effort should go into aggregation architecture — the 98% savings from batching dwarfs the difference between Groth16 and any alternative.

What This Means for Builders in 2026

The ZK tooling landscape is maturing faster than most builders realize. In 2024, choosing a proving system meant picking between Groth16 (efficient but ceremony-bound) and STARKs (transparent but expensive). In 2026, we have GLYPH-zk offering transparent proofs at SNARK-level costs, recursive STARK-to-SNARK wrapping as a standard pattern, and production-grade proof aggregation delivering 98% gas savings.

Three trends to watch through the rest of 2026:

• Glamsterdam upgrade: EIP-7732 (ePBS) and EIP-7928 (block-level access lists) will increase L1 throughput, giving ZK proofs more room in each block and potentially lowering congestion-driven verification costs.
• Precompile evolution: BLS12-381 precompiles (EIP-2537) are live. The next frontier is dedicated ZK verification precompiles that could slash proof costs by another order of magnitude.
• Circuit security: As ZK systems process more value, circuit bugs become the new smart contract bugs. Audit frameworks and formal verification tooling for ZK circuits are the next frontier.

The proving system you choose today shapes your protocol’s economics for years. Getting the math right — gas costs, batch savings, upgrade paths — is a competitive advantage, not just an implementation detail.

If you’re building on Ethereum and want to integrate ZK proofs into your application, thirdweb’s developer infrastructure gives you production-ready smart contract tooling, SDKs, and deployment pipelines that work across all major EVM chains. Whether you’re launching a ZK-powered identity system or building the next privacy protocol, thirdweb offers developer plans that scale with your project from testnet to mainnet.