Picture a garment factory in Vietnam that suddenly receives a thousand times more orders than its sewing machines can handle. The owner has two choices. Option one: buy enough machines to sew everything in-house — expensive, slow to scale, and if the factory burns down, every order stops. Option two: become a coordinator, sub-contract batches to hundreds of independent workshops, set clear deadlines and quality standards, and have an independent quality-checker inspect every shipment before it leaves.
A prover network is exactly option two — applied to the hardest problem in modern blockchain scaling: generating zero-knowledge proofs.
This article explains what a prover network is, why zk-rollups desperately need one, how proof generation works on real hardware like GPUs, and why the industry is racing to turn proof generation from a private factory into an open market.
The Problem: Proving Is Expensive and Slow
Zero-knowledge proofs (ZKPs) let a prover convince a verifier that a computation was done correctly — without the verifier re-running it. A zk-rollup batches thousands of transactions, computes the new state, and then produces a single proof that says: "This batch was processed correctly." The proof is posted to Ethereum, where a smart contract verifies it in milliseconds.
Sounds elegant. But there's a catch buried in that workflow:
Generating the proof is computationally brutal.
Why Is Proof Generation So Expensive?
Proof generation is dominated by two families of mathematical operations (Paradigm, 2022):
- MSMs (multi-scalar multiplications) — Elliptic-curve point multiplications that make up roughly 70% of proving time. MSMs are embarrassingly parallel: you can split them across thousands of GPU cores. But each operation is expensive, and the whole thing saturates the device's memory.
- FFTs (fast Fourier transforms) — These shuffle data constantly as the algorithm runs. FFTs are memory-bound: a prover may need to load and unload a dataset larger than 100 GB onto a chip with 16 GB of memory, and the data shuffling — not the math — becomes the bottleneck.
For a complex application like a zkEVM, this translates to real-world consequences:
- A single zkEVM proof can cost $0.50–$2.00 in compute (ChainScore).
- A single proof run can take minutes even on a powerful GPU cluster (Aztec measured a rollup proof dropping from 144.6s to 84.7s with GPU acceleration).
- Prover infrastructure costs can dominate a rollup's L2 fees — often more than 50% of total cost.
Figure 1: Two ways to run the proof factory
Why Rollups Need a Prover (And Why Centralization Hurts)
In most zk-rollups today, proof generation is handled by one in-house prover run by the rollup team — like the factory owner buying one giant machine and running it themselves. zkSync, Polygon zkEVM, and Scroll all run their own centralized provers (arxiv, 2024).
This works, but it recreates the exact problem blockchains exist to solve:
The Centralization Risks
- Censorship: A single operator controls which batches get proven. It can stall proofs for selected transactions — effectively freezing specific users while the chain appears healthy.
- Liveness failure: If the one prover goes down, the chain halts. The rollup cannot finalize blocks without a valid proof.
- MEV and ordering power: Whoever controls proving can coordinate with sequencing to extract maximum value from the transaction stream.
- Opaque pricing: With a monopoly prover, users pay whatever the operator decides. There's no competition forcing prices down.
The Ethereum Foundation's own docs warn that validity-proof generation "requires specialized hardware, which may encourage centralized control of the chain by a few parties."
There's also a subtler, nastier attack — the prover killer. Academic researchers showed in 2025 (arxiv 2509.17126) that because EVM gas measures execution cost but not proving cost, an attacker can craft cheap transactions that are wildly expensive to prove. One such attack delayed finality by more than 8 hours (94×) while costing just ~$42 per block.
What Is a Prover Network? The Distributed Proof Factory
A prover network is an open marketplace where many independent provers compete to generate proofs. Instead of one factory owner doing all the sewing, the rollup — or any user — posts a proof request and lets the market decide who fulfills it.
The architecture (based on Succinct, =nil, and Boundless designs):
` Proof request (circuit + inputs + deadline) │ ▼ ┌─────────────────────────────────────────┐ │ Prover Network Marketplace │ │ - Succinct: auction, lowest bid wins │ │ - =nil: order book ("Proof DEX") │ │ - Boundless: permissionless provers │ └─────────────────────────────────────────┘ │ prover chosen / self-selects ▼ Prover A (GPU) ──┐ Prover B (GPU) ──┼──► L1 Verifier (QC) ──► finality Prover C (FPGA) ─┘ `
The key components:
1. Proof Requests
A request specifies the circuit to prove, the public and private inputs, and a deadline. The proof has an expiration time — a zk-bridge proof for Mina, for example, must be fresh (within ~15 minutes), so latency is part of the product.2. Matching (Auction or Staked Selection)
Two main designs:- Auction-based: The marketplace matches the request to the prover offering the best price/latency (Succinct Prover Network assigns jobs through an open auction; =nil runs an order book).
- Stake-based: Provers stake tokens, and the protocol selects provers weighted by stake — with slashing for misbehavior (Scroll's prover selection; Taiko's bonded provers).
3. Proving
The chosen prover runs the computation on its hardware — typically GPU clusters today. Parallelism is the whole game: MSMs split across thousands of cores; recursive proof systems (Plonky2, Halo2) let many machines generate proofs for many transactions in parallel, then aggregate them into a single proof.4. Verification (The Quality Check)
The prover submits the proof on-chain within the proving window. The L1 verifier contract — the independent quality-checker — validates it deterministically for a few hundred thousand gas. Nobody trusts the prover's word; the QC checks everything.5. Payment and Accountability
If the proof is valid and on time, the prover gets paid. If it's late or invalid, part of the prover's bond is slashed. Taiko's protocol, for example, slashes 50% of the prover's bond for a late proof. Provable performance builds reputation, which translates into more future work and better prices.
Figure 2: Life of a proof request
Why GPU ZK Proving? (The Hardware Question)
The economics of a prover network live or die on hardware. Proof generation is hardware-bound: the asymptotic magic of recursive proofs still has to run on real silicon.
The Hardware Ladder
| Tier | Analogy | Speed | Cost per proof | Flexibility |
|---|---|---|---|---|
| CPU | Hand-sewing | Slowest | High | Total |
| GPU | Sewing machines | Fast, massively parallel | Low (post-mining surplus) | High |
| FPGA | Automated line (re-flashable) | Fast + power-efficient | Same per-watt as GPU, worse per-dollar today | Medium |
| ASIC | Purpose-built single-product line | Fastest | Lowest | None (write-once) |
The GPU Story
Today, GPUs win the factory floor — and this is exactly the "gpu zk proving" story:
- MSMs (70% of proving time) are embarrassingly parallel — a perfect GPU workload.
- Ethereum's proof-of-stake merge left a glut of cheap, high-end GPUs on the market.
- Aztec's benchmark: a single 2^24 MSM takes 4,255 ms on a 32-vCPU CPU but 196 ms on an A10G GPU — and the GPU instance produced 15,055 MSMs per dollar vs 786 for the CPU instance.
- Cysic's 2026 revisit confirms: "GPU dominates production today."
FPGAs match GPUs on performance-per-watt but can't beat them on performance-per-dollar today. ASICs would win on both — but take 12–18 months to reach market, are write-once, and only make sense if the proof system stabilizes forever. Paradigm's 2022 prediction holds: CPUs → GPUs → FPGAs first, with ASICs possibly never.
Figure 3: The hardware ladder — who can prove
Real-World Prover Networks Today
The trend from private factory to open market is not hypothetical — it's already happening:
Succinct Prover Network
An open proving marketplace: proof requests are assigned to third-party provers through a competitive auction. Succinct Labs also keeps reserved capacity for guaranteed latency and SLAs.=nil; Foundation Proof Market
The first operating marketplace for outsourcing non-interactive proof generation. An order book where proof generators bid on circuits, generate proofs with their hardware, and get paid on verified submission. Includes an Ethereum endpoint so EVM apps can request proofs directly.RISC Zero: Bonsai → Boundless
The clearest before/after story. Bonsai was RISC Zero's centralized proving service (API key, single operator, "simple but centralized"). In December 2025, Bonsai was deprecated. Its replacement, Boundless, is a decentralized proving marketplace: permissionless provers bid on proof requests, deposit collateral to lock in jobs, and run the open-source Bento proving cluster. The migration is explicit: "Boundless is the blockchain-native way... aligned with Web3's core principles."Gevulot
A "universal proving layer" that aggregates proof workloads from many protocols. Its Firestarter network is production-ready (permissioned); the permissionless ZkCloud network launched in 2025.Taiko
A based zkEVM using multi-proof (SP1, RISC0, SGX) with a bonded prover system: provers post bonds, the protocol slashes 50% for late proofs, and designated-prover auctions let the proposer pick the cheapest bonded prover.
Figure 4: Centralized prover vs prover network
The Tradeoffs: Nothing Is Free
A prover network is not strictly better — it's a trade:
| Dimension | Centralized Prover | Prover Network |
|---|---|---|
| Latency | Lowest (10–30s, single operator) | +2–10s marketplace overhead |
| Cost | Monopoly pricing, opaque | Auction-driven, competitive long-term |
| Censorship | Single operator controls batches | Permissionless; no single censoring party |
| Liveness | Single point of failure | No single point of failure |
| Coordination | Trivial | Hard — matching, bonds, slashing, disputes |
The harder problems are economic, not technical:
- Collusion: If the few provers with enough hardware collude, they can raise prices — like a cartel of workshops fixing prices. There will always be fewer provers than validators because proving needs expensive hardware (arxiv 2404.06495).
- Sybil: A prover with a big GPU farm can create many fake identities to win more jobs.
- OCA (off-chain agreement): Provers can collude with users outside the protocol to manipulate prices.
- Mechanism design: Getting staking, slashing, and auction rules right is an active research area.
FAQ: Your Questions Answered
Q: What is a prover network?
A: An open marketplace where independent provers compete to generate zero-knowledge proofs for rollups, bridges, and ZK apps. Rollups post proof requests; the market decides who proves them.Q: Why is proof generation so expensive?
A: Proving is dominated by MSMs (~70% of time, embarrassingly parallel but memory-hungry) and FFTs (memory-bound, data-shuffling heavy). It's hardware-bound compute, so specialized GPUs and eventually FPGAs/ASICs matter enormously.Q: Why do rollups need provers at all?
A: A zk-rollup must post a validity proof on Ethereum to finalize each batch. Without a proof, the batch can't settle. So proving is a mandatory, expensive step in every ZK rollup's lifecycle.Q: Is a decentralized prover network slower?
A: Slightly — marketplace matching adds roughly 2–10 seconds vs a single operator. In exchange you get censorship resistance, liveness, and competitive pricing.Q: How do prover networks prevent cheating?
A: Staking + slashing (provers lose their bond if they're late or wrong) + reputation (proven performance wins future jobs). The L1 verifier contract does deterministic quality-checking.Q: GPU or FPGA or ASIC — which will win?
A: GPUs dominate today (cheap, parallel, post-merge surplus). FPGAs are competitive on power but not per-dollar. ASICs would win on speed and cost but are write-once and take 12–18 months — likely only if proof systems stabilize.Q: Is "prover phân tán" (decentralized prover) the same thing?
A: Yes — the Vietnamese term maps directly to "decentralized prover network." The core idea: proof generation becomes a commodity traded on an open market instead of a private monopoly.Summary: From Private Factory to Open Market
The zk-rollup industry has a proof bottleneck: generation is expensive, hardware-bound, and — when centralized — a censorship and liveness risk. Prover networks solve this by turning proof generation into an open, competitive marketplace:
- Why: Proving is 70% MSM, memory-bound, and costly — a natural candidate for parallel hardware and market economics.
- How: Proof requests → auction/staked matching → GPU proving → deterministic on-chain QC → payment or slashing.
- Where: Succinct, Boundless (ex-Bonsai), =nil, Gevulot, Taiko are live today.
- Tradeoff: A few seconds of latency for censorship resistance, liveness, and competitive pricing.
The prover network is where the "proof factory" stops being a single private factory and becomes a distributed network of workshops — each with its own GPUs, each accountable through staking, all feeding one unbiased quality-checker: the verifier contract.
Understanding the prover network isn't about blockchain trivia — it's about why the cheapest, fastest, and most censorship-resistant rollups of the next decade will be built on distributed proof markets, not private proving monopolies.
Word count: ~2,250 | Primary keyword: "prover network" | Secondary: "gpu zk proving", "prover phân tán"