A zk rollup is the blockchain equivalent of a Bến Thành wholesaler who packs 500 áo sơ mi into one container, ships it once, and splits the freight cost across every shirt — instead of sending each shirt by express mail. The result: zk rollup phí giao dịch drops from dollars to cents, because the expensive part (posting data to Ethereum) is shared.
One sentence: zkRollup gom hàng nghìn giao dịch vào một batch, tạo một bằng chứng ZK duy nhất, và chia chi phí calldata cho tất cả user — nên mỗi người chỉ trả một phần nhỏ.
If you've wondered why l2 gom giao dịch makes fees 10–20x cheaper than Ethereum mainnet, or why rollup phí rẻ is the magic behind zkSync, Starknet, and Linea — this article breaks it down with the wholesale market analogy that makes it click.
Figure 1: The Wholesale Container — 1000 transactions share 1 proof and 1 calldata post
The Problem: Retail Shipping Is Expensive
On Ethereum mainnet, every transaction is a separate "express package":
- You pay for state write (updating the blockchain's ledger)
- You pay for calldata (publishing your transaction data on-chain)
- You pay priority fee (tip to validators)
- Total: $1–$5+ per simple transfer
A zk rollup changes the game: wholesale shipping.
What a zk Rollup Actually Does
- Users submit transactions to the L2 operator (sequencer).
- Operator batches transactions — hundreds or thousands — off-chain.
- Operator generates ONE validity proof (ZK-SNARK or ZK-STARK) proving the entire batch is correct.
- Operator posts to Ethereum: the proof + compressed batch data (calldata).
- Ethereum verifies the proof — if valid, the new state root is accepted.
The magic: one proof, one calldata post, thousands of transactions. The fixed costs (proof verification ~500k gas, state write) are paid once. The variable cost (calldata) is compressed and split.
The Fee Breakdown: Where Your Money Goes
| Cost Component | Ethereum L1 (per tx) | zkRollup (per tx, batched) |
|---|---|---|
| State write | ~21,000 gas (fixed) | ~21,000 gas ÷ batch size |
| Calldata | ~100–200 bytes × 16 gas | Compressed (index vs address) ÷ batch |
| Operator fee | N/A | Small tip to sequencer |
| Proof verification | N/A | ~500,000 gas ÷ batch size |
| Total | $1.00–$5.00+ | $0.05–$0.20 |
Real data (l2fees.info): zkSync Era ~$0.07 send ETH, Starknet ~$0.19, Ethereum L1 ~$1.10.
Figure 2: Fee Breakdown — fixed costs amortized, calldata compressed, batch wins
Why so cheap?
- Calldata compression: accounts as 4-byte index instead of 20-byte address (saves 28 bytes/tx). Zero bytes cost 4 gas vs 16 gas for non-zero.
- Fixed costs amortized: 500k gas proof verification split across 1,000 tx = 500 gas each.
- No per-tx signature verification on L1: the ZK proof covers the whole batch.
Validity Proofs: The Receipt That Covers Everything
A validity proof (ZK-SNARK or ZK-STARK) is a cryptographic receipt saying: "I verified every transaction in this batch — sender has funds, balances update correctly, no double-spends."
- ZK-SNARK: small proof (~200 bytes), constant-time verify, needs trusted setup (ceremony). Used by zkSync (Boojum), Polygon zkEVM.
- ZK-STARK: larger proof (~50–100 KB), transparent (no trusted setup), quantum-resistant, quasilinear scaling. Used by Starknet.
Both are verified on Ethereum by a verifier contract. If proof passes, the new state root is canonical. No re-execution needed.
The Proving Circuit: How the Receipt Is Made
The proving circuit "loops" over every transaction in the batch:
` For each tx in batch: 1. Verify sender account exists in current state root (Merkle proof) 2. Check sender balance ≥ amount 3. Decrease sender balance, increase nonce 4. Hash updated account + Merkle proof → new intermediate state root 5. Verify receiver account exists in intermediate root 6. Increase receiver balance 7. Hash updated account + Merkle proof → new intermediate state root End loop Final state root = post-state root Batch root = Merkle root of all tx in batch `
The circuit outputs: pre-state root, post-state root, batch root, transaction inputs. The verifier checks: proof valid + pre-state matches on-chain root → accept post-state.
Recursive Proofs: Container of Containers
Recursive proofs take this further: instead of verifying one block proof at a time, the circuit verifies multiple block proofs and outputs ONE proof.
` Block 1 proof → Block 2 proof → Recursive circuit → ONE recursive proof → Ethereum verifies once Block 3 proof → ... Block N proof → `
Result: finalize N blocks with one L1 verification. Throughput multiplier. This is how zkVMs (RISC Zero, SP1) and advanced rollups scale further.
Figure 3: Recursive Proofs — container of containers, throughput multiplier
Data Compression Tricks
| Technique | Savings |
|---|---|
| Account index (4 bytes) vs address (20 bytes) | 28 bytes/tx |
| Non-zero byte: 16 gas → Zero byte: 4 gas | Encode common values as zero |
| Batch Merkle root only | O(1) calldata for batch inclusion |
| Transaction input compression | Only essential fields posted |
zkSync Era's Boojum prover uses Plonk + custom gates for efficient batch proving. Starknet's Cairo VM compiles to STARK-friendly AIR.
Real-World Fee Comparison
| Network | Send ETH | Swap Tokens | Type |
|---|---|---|---|
| Ethereum L1 | $1.10 | $5.48 | Base layer |
| zkSync Era | $0.07 | — | ZK-Rollup (SNARK) |
| zkSync Lite | $0.09 | $0.22 | ZK-Rollup (SNARK) |
| Loopring | $0.04 | $0.59 | ZK-Rollup (SNARK) |
| Starknet | $0.19 | $0.57 | ZK-Rollup (STARK) |
| Polygon zkEVM | $0.19 | $2.75 | ZK-Rollup (SNARK) |
| Optimism / Arbitrum | $0.09 | $0.18–$0.27 | Optimistic Rollup |
Source: l2fees.info (live data). ZK-rollups generally cheapest for simple transfers.
The Honest Tradeoff
What you gain:
- 10–20x cheaper fees
- Near-instant finality (proof verified → state final)
- Self-custody: anyone can reconstruct state from calldata + withdraw via Merkle proof
What you give up:
- Centralized sequencer risk: most rollups use single operator (censorship possible, mitigated by forced exit via L1)
- Proof generation hardware: specialized GPUs/FPGAs for provers (centralization pressure)
- Trusted setup (SNARKs): ceremony risk if all participants compromised
- EVM compatibility: not all opcodes supported equally (Type 1–4 spectrum)
Common Questions About zk Rollup Fees
Why are zk rollup fees so cheap?
Batching splits fixed costs (proof verification, state write) across thousands of transactions. Calldata is compressed (index vs address, zero-byte encoding).What is "l2 gom giao dịch"?
Vietnamese for "L2 aggregates transactions" — the operator collects many user tx, executes off-chain, proves correctness with one ZK proof, posts one batch to Ethereum.How does batching reduce calldata cost?
Ethereum charges 16 gas/non-zero byte, 4 gas/zero byte. Rollups compress: 4-byte index instead of 20-byte address, encode repeated values as zeros. 1000 tx → ~10 KB calldata vs ~200 KB raw.What's the difference between ZK-SNARK and ZK-STARK rollups?
SNARK: small proof, fast verify, trusted setup. STARK: larger proof, transparent, quantum-resistant. Both verify batch correctness on Ethereum.Can a malicious operator steal funds?
No — validity proof guarantees state transitions are correct. Operator can only censor (omit your tx), not execute invalid ones. Forced exit via L1 protects against censorship.How do withdrawals work?
User sends tx to burn account on L2. After batch finalized, user submits Merkle proof + batch root + tx data to L1 contract. Contract verifies inclusion → releases funds. Near-instant.Which zk rollups are live today?
zkSync Era, Starknet, Polygon zkEVM, Scroll, Linea, Taiko, ZKsync Lite, Loopring. zkEVM types range from Type 1 (Ethereum-equivalent, Taiko) to Type 4 (high-level language, zkSync).What are recursive proofs in rollups?
One proof verifies multiple block proofs. Instead of verifying Block 1, then Block 2, then Block 3 on L1 — recursive circuit verifies all three, outputs one proof. L1 verifies once, finalizes all three.The Bottom Line
A zk rollup is a wholesale shipping container for transactions. Instead of each user paying full freight (L1 gas), the operator packs thousands of tx into one batch, generates one ZK receipt, posts one compressed calldata blob — and everyone splits the bill.
zk rollup phí giao dịch drops to pennies because:
- Fixed costs amortized (proof verification, state write)
- Calldata compressed (index, zero-byte encoding)
- One proof covers all (validity proof for entire batch)
- Recursive proofs multiply (container of containers)
The Ben Thanh wholesaler doesn't care about the shirt design — they care about packing the container full. zkRollup doesn't care about your tx purpose — it cares about packing the batch full. Full container = lowest cost per shirt. Full batch = lowest fee per tx.
Quick Reference
| Property | zkRollup |
|---|---|
| Core mechanism | Batch tx off-chain → 1 ZK proof → 1 calldata post |
| Fee per tx (simple transfer) | ~$0.05–$0.20 (vs $1–$5 L1) |
| Calldata cost | 16 gas/non-zero byte, 4 gas/zero byte (EIP-1559) |
| Compression | 4-byte index vs 20-byte address |
| Proof verification | ~500k gas fixed, split across batch |
| Recursive proofs | Aggregate N block proofs → 1 L1 verify |
| Finality | Instant after proof verified on L1 |
| Self-custody | Yes — reconstruct state from calldata |
| Main risk | Sequencer centralization (censorship) |
| Live examples | zkSync Era, Starknet, Polygon zkEVM, Scroll, Linea, Taiko |