BN128 curve operations

Question

Who uses the BN128 elliptic curve precompiles and what does the usage pattern look like?

Background

The three BN128 (alt_bn128) precompiles are used together for on-chain ZK proof verification:

• ecAdd (0x06) - Point addition. Fixed cost: 150 gas. 5.7M calls.
• ecMul (0x07) - Scalar multiplication. Fixed cost: 6,000 gas. 5.6M calls.
• ecPairing (0x08) - Pairing check. Variable cost: 34,000 base + 45,000 per pair. 208K calls.

ecAdd and ecMul are cheap and called frequently. ecPairing is expensive (avg 129,000 gas) but called far less. Together they account for 32.4% of all precompile gas, almost entirely from ecMul and ecPairing.

ZK rollups and privacy protocols use these for Groth16 and other SNARK verification on-chain.

Investigation

Gas distribution

ecAdd (150 gas) and ecMul (6,000 gas) are fixed-cost. ecPairing varies with the number of pairs being checked.

Top callers

The stacked bar shows which contracts use BN128 operations and in what combination. ZK verifiers typically call all three together.

Note: The callers data below covers a smaller window (~6,000 blocks) because the self-join query needed to resolve parent contracts is too expensive to run over the full range. The gas distribution above uses the full 426K-block range.

Takeaways

• BN128 operations account for 32.4% of precompile gas, driven by ecMul (17.8%) and ecPairing (14.2%)
• ecAdd and ecMul are fixed-cost; ecPairing varies with the number of pairs
• Used together for on-chain ZK proof verification (Groth16, etc.)