We are partnering with RISC Zero to bring NEBRA UPA powered RISC ZERO zkVM proofs onchain. RISC ZERO developers can enjoy 10x and more cheaper proof verification cost on Ethereum and Its L2s. Additionally, RISC ZERO zkVM developers can compose RISC ZERO zkVM proofs with external proofs such as World ID.

How NEBRA can reduce RISC ZERO developers’ onchain cost by 10x?

The RISC Zero zkVM can prove the correct execution of arbitrary code, allowing developers to build ZK applications in mature languages like Rust and C++. The release of the RISC Zero zkVM marked a major breakthrough in enabling ZK software development: the zkVM made it possible to build a ZK application without having to build a circuit and without writing in a custom language.

Notably, RISC Zero is over 70% of the top 1000 Rust crates work out-of-the-box in the zkVM. Being able to import Rust crates is a game changer for the ZK software world: projects that would take months or years to build on other platforms can be solved trivially on our platform.

The last mile of the RISC Zero developers’ journey is settling the proof onchain. Today, the onchain proof verification cost is prohibitive: developers need to spend more than 250,000 gas, which is equivalent to 20 US dollars on Ethereum or 2 dollars on Ethereum L2s.

NEBRA UPA is the first Universal Proof Aggregation protocol that scales and composes zero-knowledge proof verification on Ethereum/EVM chains. NEBRA UPA achieves this using recursive SNARKs with cryptographic security.

There are 3 key properties of NEBRA UPA:

• Universality: NEBRA UPA can aggregate proofs from any circuit. This means that in the same batch, NEBRA UPA aggregates proofs from different sources, such as zkEVMs, zkDIDs, and zkCoprocessors. Universality brings an "economy of scale" to NEBRA users, allowing them to enjoy cheap amortized verification costs without needing to generate a huge number of proofs.
• Permissionless: NEBRA UPA is an onchain protocol, meaning that anyone can submit proofs to NEBRA.
• Censorship resistance: NEBRA UPA is censorship resistant by adopting a forced-inclusion design similar to Ethereum L2s. You can trigger a forced inclusion to include your proofs if our off-chain worker refuses to put your proof in the aggregated proof. Additionally, we would be slashed if a forced inclusion occurs.

By using NEBRA UPA, RISC Zero developers can lower their proof verification costs from 250,000 gas to roughly 18,000 gas, translating to approximately 10x onchain verification cost savings.

Why RISC Zero?

RISC Zero is the pioneer of building RISC-V zkVMs. RISC Zero zkVM is high performance. As one of the most mature zkVMs, there are a number of applications and primitives showcasing RISC Zero’s capabilities, including:

• Zeth: prove the correct construction of an entire Ethereum block or an entire Optimism block
• Bonsai Pay: send Ethereum to someone's gmail address
• JSON: prove the contents of some entry in a JSON file, while keeping the rest of the data private
• Where's Waldo: prove that Waldo appears in a JPG file, while keeping the rest of the image private
• ZK Checkmate: prove that you see a mate-in-one, without revealing the winning move
• ZK Proof of Exploit: prove that you could exploit an Ethereum account, without revealing the exploit
• ECDSA signature verification: prove the validity of an ECDSA signature

In addition, RISC Zero developers can enjoy the upcoming Bonsai prover network to streamline the development process. NEBRA UPA will be supporting both developers who are deploying stand-alone RISC Zero zkVM or Bonsai Prover Network.

Additional Resources:

• NEBRA UPA Docs:

• RISC Zero zkVM:

• RISC Zero Bonsai:

• NEBRA Community:https://t.me/+niuKbgHIQ2lmN2Ex

We are partnering with Succinct to bring cheap and accessible zero-knowledge proofs to all developers. We are committed to supporting Succinct SP1 zkVM proofs generated locally or from Succinct’s prover market on NEBRA UPA. This will enable all projects and developers using Succinct’s zkVM proofs to lower their onchain verification costs by 10x or more.

How NEBRA can reduce SP1 developers’ onchain cost by 10x?

Succinct is building SP1, an open-source, RISC-V zkVM with state-of-the-art performance that is useful for rollups, bridges, and other blockchain applications. Developing zero-knowledge proof-based protocols used to be notoriously difficult, as developers needed to learn and express their logic using very exotic constraint satisfaction languages, such as Circom, or write the circuits in raw form using embedded DSLs like Halo2’s circuit writing libraries.

With RISC-V zkVMs such as Succinct SP1, developers now only need to write programs in familiar languages, such as Rust. This is a significant breakthrough for those building any proof-based infrastructures and applications, such as bridging, co-processors, and zkRollups.

The last mile of the SP1 developers’ journey is settling the proof onchain. Today, the onchain proof verification cost is prohibitive: developers need to spend more than 250,000 gas, which is equivalent to 20 US dollars on Ethereum or 2 dollars on Ethereum L2s.

NEBRA UPA is the first Universal Proof Aggregation protocol that scales and composes zero-knowledge proof verification on Ethereum/EVM chains. NEBRA UPA achieves this using recursive SNARKs .

There are 3 key properties of NEBRA UPA:

• Universality: NEBRA UPA can aggregate proofs from any circuit. This means that in the same batch, NEBRA UPA aggregates proofs from different sources, such as zkEVMs, zkDIDs, and zkCoprocessors. Universality brings an "economy of scale" to NEBRA users, allowing them to enjoy cheap amortized verification costs without needing to generate a huge number of proofs.
• Permissionless: NEBRA UPA is an onchain protocol, meaning that anyone can submit proofs to NEBRA.
• Censorship resistance: NEBRA UPA is censorship resistant by adopting a forced-inclusion design similar to Ethereum L2s. You can trigger a forced inclusion to include your proofs if our off-chain worker refuses to put your proof in the aggregated proof. Additionally, we would be slashed if a forced inclusion occurs.

By using NEBRA UPA, SP1 developers can lower their proof verification costs from 250,000 gas to roughly 18,000 gas, translating to approximately 10x onchain verification cost savings.

Why Succinct SP1?

There are many reasons that developers should use SP1:

• SP1 is the zkVM with a complete feature set that includes precompiles, SOTA (state-of-the-art) performance, and Rust standard library support.
• SP1 has state of the art performance with precompiles already supported (keccak, sha, signature verification) leading to 5-10x cycle reduction on real-world workloads. In practice, this can be 30x cheaper and faster than competing VMs.
• SP1 has open source constraints that are essential for security and auditability, and allow for adding precompiles to accelerate any workload.

SP1 will be integrated with Succinct’s upcoming prover network, providing developers with a more streamlined experience and lower prover costs.

The high cost of verification is one of the biggest obstacles preventing applications from taking full advantage of zero-knowledge proof technology. Despite the hefty price tag, enough use-cases already exist to justify current spending of nearly $100 million/yr to verify proofs on Ethereum. Our thesis at NEBRA is simple: by slashing verification costs, we not only enable existing zk-apps to scale to new heights, but also pave the way for entirely new use-cases and applications for zero-knowlege proofs.

In this blog post, we delve into the gas savings that NEBRA UPA brings to zero-knowledge applications. Our current UPA release (v1.1) offers end-to-end gas savings of more than 70%. UPA is fully deployed on Sepolia testnet, ready for developers to integrate their applications. Improvements coming in the near future are slated to push these savings even further, to over 90%.

Verification cost without UPA

The cost of verifying an individual Groth16 proof and using the result can be broken down into two parts:

• Submitting and verifying the proof (~250k gas)
• Retrieving the verification result
  • from an external contract (~10-20k gas)
  • from within the app contract (0 gas)

Gas savings with UPA

Let's take a look at the end-to-end gas cost for a ZK app using NEBRA UPA. These are the three steps that can consume gas, along with their current per-proof costs. (The exact costs may vary a bit based on the details of the application):

• Submitting proofs
  • on-chain (~23-100k gas per proof- depends on submission size)
  • off-chain (0 gas per proof)
• Verifying the aggregated proof (~18k gas per proof)
• Querying the verification result (~25k gas per proof)

Summing up these costs, we find that in total:

• Applications submitting their proofs on-chain can save as much as 184k gas (~75%) per proof.
• Applications submitting their proofs off-chain can save upwards of 207k gas (~85%) per proof.

The cost of each step can be further reduced with greater amortization. For example, we can increase the aggregation batch size, which is currently set to just 32 proofs. And, as we discuss in the gas cost breakdown, we also expect to see lower submission and query costs coming from continued development of the UPA contracts and additional features.

As always, the set of factors that go into an apples-to-apples comparison depend on the use case. For instance, the third query step is an "extra" cost for applications that would normally verify the proof inside the app contract. But for applications that use ZK co-processors (such as Brevis or Bonsai), this external query cost is already "built-in" to the app's protocol. With the breakdown of costs to follow, developers can take the right factors into account to determine where NEBRA UPA can offer them gas savings.

See our Gas Estimator to calculate the gas savings for your particular apps.

Breakdown and scaling of UPA gas costs

Step 1: Proof submissions

NEBRA UPA collects submissions of one or more proofs and places them in a queue to be aggregated. Note that UPA does not aggregate submission-by-submission. Instead, aggregated batches are chosen independently of the way the proofs were submitted.

Applications will have two options for sending submissions to UPA: on-chain and off-chain. On-chain submissions cost gas in exchange for censorship-resistance. Off-chain submissions have no gas cost, but offer weaker censorship resistance.

Our current UPA release (v1.1) supports on-chain submission. Off-chain submission will be available soon.

Cost of on-chain submission

Due to per-transaction storage costs, using a whole Ethereum transaction to submit a single proof is relatively expensive. Instead, we recommend that apps take advantage of multi-proof submissions.

The contracts currently deployed to the Sepolia testnet are initial implementations with large scope for gas optimization, but they serve to illustrate the approximate cost model. Currently, the fixed cost per submission is ~100k gas. The marginal cost of each additional proof in a submission is ~20k gas (for processing the additional proof and public input data).

Therefore the per-proof gas cost for an on-chain submission of  $M$ proofs is approximately:

$$100000/M + 20000$$

The table below shows the measured cost of submissions of different sizes.

As we iterate the contracts and introduce more optimizations, we expect to significantly reduce the costs shown here.

Step 2: Aggregated proof verification

The current version of NEBRA UPA aggregates proofs into a Halo2-KZG proof. The cost of verifying such a proof in isolation is about 350k gas, and is roughly independent of batch size. In addition, the UPA contract emits an event and updates its storage to mark each application proof in the batch as verified. This incurs a marginal per-proof cost of about 7k gas.

Therefore the per-proof gas cost for verifying one batch of $N$ proofs and storing the result is approximately:

$$350000/N + 7000$$

The current configuration of NEBRA UPA sets the batch size to $N=32$. With this batch size the aggregated verification cost comes out to ~18k gas per-proof (Etherscan).

Step 3: Querying the verification result

Once a proof has been verified by the UPA contract, the app contract may query the UPA contract to confirm that the associated public inputs are valid. This typically looks like:

require(upaVerifier.isVerified(circuitId, publicInputs, "Not verified");

The gas cost of this external contract call is about 25k gas per proof.

In the near future, apps will be able to amortize this cost by checking that a whole multi-proof submission has been verified instead of checking each of its proofs individually.

End-to-end gas savings

Using on-chain submission

With UPA, assuming submissions of size $M$ and proof aggregations of size $N$, the total end-to-end per-proof gas cost with on-chain submissions comes out to about:

$$100000/M + 350000/N + 52000$$

Concretely, with submissions of $M=32$ proofs and aggregations of $N=32$ proofs, this per-proof gas cost comes out to

$$100000/32 + 350000/32 + 52000 \approx 66000$$

which represents a savings of about 184k gas (~75%).

Using off-chain submission

The end-to-end gas cost with off-chain submissions will be approximately:

$$350000/N + 32000$$

With the current UPA configuration of $N=32$, the per-proof cost comes out to

$$350000/32 + 32000 \approx 43000$$

which represents a savings of about 207k gas (~85%).

Brevis is a ZK coprocessor that empowers smart contracts to read the full historical onchain data and run customizable compute using zero-knowledge proofs. With the power of trust-free historical data, Brevis enables many new use cases such as data-driven DeFi, trust-fee active liquidity management, omnichain activity-based identity, and many more.

Empower DeFi

As a ZK coprocessor, Brevis generates a huge amount of proofs of customizable computation based on historical onchain data, one example is to use Uniswap V4 hooks + Brevis+ Brevis to provide data driven DEX experiences. To get ZK coprocessors to the masses, it is crucial to leverage proof aggregation and the shared economy from NEBRA to lower the end-to-end cost for users. The Brevis team has done earth-moving engineering work to lower the proving cost. Now, integrating NEBRA brings down the proof verification cost to empower the DeFi space. The collaboration with NEBRA makes Brevis the most cost-efficient coprocessor in the market.

How can NEBRA UPA help Brevis?

More specifically, NEBRA UPA aggregates multiple proofs (from different parties, applications etc) into a single aggregated proof onchain. By using NEBRA UPA as the shared settlement layer of the proofs, the proof verification cost gets amortized among different parties. NEBRA UPA 1.0 brings the proof verification cost down by 10x on both Ethereum and its L2s.

NEBRA is going to support Brevis team's mission of bringing trust-free computation over historical data to a wide variety of users. NEBRA UPA is going to be integrated into the last step of Brevis proof settling pipeline as shown in the picture below:

NEBRA team is excited to onboard Brevis as the first NEBRA UPA partner and excited for further collaborations in the years to come.

Let’s bring ZKP to the masses!

Interested in building with NEBRA?

If you are interested in trying out NEBRA’s UPA click here.

AltLayer is an open and decentralized protocol for rollups. AltLayer brings together novel ideas, such as Restaked rollup, which takes existing rollups (spun from any rollup stack such as OP Stack, Arbitrum Orbit, ZKStack, Polygon CDK, etc.) and provides them with enhanced security, decentralization, interoperability, and crypto-economic fast finality.

With this latest integration, Nebra’s UPA will aggregate the proofs into smaller units and settle them on Ethereum. This will enable our builders and users to benefit from reduced on-chain verification costs and improved interoperability.

NEBRA’s Role

At NEBRA, we talked to many developers who want to launch rollup-based AppChains. The primary concern that prevents people from launching a ZK-based AppChain today is cost. And the cost can be broken down into the prover cost and verification cost. With the rapid progress of the zero-knowledge proof system, the prover cost has been reduced dramatically over the years, however, the verification cost remains a high barrier to entry to many builders. Here is a break-down of the Rollup verification cost (in USD) for rollup runners:

As shown in the table, even if a zkRollup settles the proof at a low frequency (once every hour), the rollup runner still needs to pay tens of thousands of dollars for the verification cost. We predict that the high performance rollups especially those are handling big trading volumes or developing latency sensitive gaming will settle the proof more frequently, even at the rate of every single block (a.k.a. Proof Singularity). This high proof verification cost is one of the biggest problems preventing people from building the next 10,000 zkRollups.

NEBRA UPA (Universal Proof Aggregation) solves the problem by using recursive snarks. NEBRA brings the shared economy to zero-knowledge proof verification. Thanks to its universality, proofs from different sources, such as zkML, zkRollup, zkDID, zkCoprocessors can be aggregated into a single proof and the verification cost gets amortized.

The figure below shows ZKP verification cost using NEBRA UPA with various batch size (https://docs.nebra.one/developer-guide/gas-costs)

The NEBRA team is more than excited to work alongside Altlayer to bring the next 1,000 zkRollups.

Interested in building with NEBRA?

If you are interested in trying out NEBRA’s UPA click here.

Blockchains are a trustless, globally distributed coordination technology, available for anyone to use without permission; zero-knowledge proofs bring privacy and scalable computations to blockchains. Together, we believe blockchains and zero-knowledge proofs enable better coordination technology at scale, for humans and machines.

In the years to come, we envision that zero-knowledge-proof-powered applications will proliferate in the Ethereum ecosystem and more, far beyond their current level of usage. In this future, zero-knowledge proofs from many different circuits, proof systems, generated by different parties, exist together and are composed by users in order to verify more complex statements onchain.

However, today it is still prohibitively expensive to verify zero-knowledge proofs onchain. In fact, people have already spent more than $50 million worth of gas fees verifying proofs on Ethereum and its layer 2s. As the zero-knowledge future proliferates, and Ethereum becomes increasingly used for its security, we believe this number will continue to grow.

This expensive proof verification cost means only a few kinds of applications can be built today (the ones that can justify the high verification cost), and only a subset of users have access to proof verification (the ones that can afford it). We believe a future where onboarding to vote privately on a DAO costs $20 will exclude a majority of the world, a majority who we believe blockchain technology should also serve.

Solving this problem is critical to ushering the zero-knowledge future for all.

One solution is to equip Ethereum validators with specialized hardware for zero-knowledge proof verification. While this would likely provide a significant improvement on the status quo, it would come at the expense of validator decentralization by increasing the barrier to entry for running a validator.

Another solution, which wouldn’t compromise on validator decentralization, is using zero knowledge proofs themselves to scale zero knowledge proof verification. Thanks to advances in highly efficient recursive SNARKs ( IVCs/ PCDs), we can now get a near unlimited amount of recursion. This means we can recursively prove multiple zero-knowledge proofs off chain, and verify only a single aggregated proof onchain. This significantly improves on the status quo, and provides nearly unbounded efficiency*.

This is what we’re building at NEBRA. NEBRA is a research & development organization working to make the zero-knowledge future a reality. We research and build technologies, infrastructure, and products to facilitate the mass adoption of zero-knowledge proofs.

Our first step towards this goal is to scale the proof settlement capabilities of Ethereum in a trustless and censorship resistant manner. To achieve this, we are developing Universal Proof Aggregation technologies, to aggregate proofs generated from different circuits, different proof systems and different parties. Our second step will use this technology to bootstrap a decentralized proving network that can horizontally scale proving power with an increasing number of nodes.

Building NEBRA will be a long, challenging journey in a field advancing at an increasingly rapid pace. In order to fulfill our mission, we believe we will not only need to be on top of the latest research results in the field, but will also need to be able to turn these results into secure and performant engineering solutions. This applied cryptography r&d muscle will be built both internally from the research-driven culture we will foster, and externally from working with a community of talented researchers and engineers in the space, sharing our vision for the future.

As we embark on this journey, we commit to defending ethereum’s values of decentralization, permissionlessness and censorship-resistance. We also commit to working in the open, and making all our code open-source for the community to use and benefit from. We’re excited to share more over the next months, and to usher together the zero-knowledge future for all humans and machines.

We welcome your contributions to NEBRA, and would love to welcome you in our community. Please reach out to community@nebra.one if you’d like to chat! (We appreciate Alex Obadia’s help on forming the article)

* There is a latency/throughput tradeoff.

– NEBRA Founding Team

Shumo Chu, Francisco Hernández, Vincent Liew, Todd Norton, Akilesh Tangella, Duncan Tebbs, Afra Wang