The Spreadsheet That Wouldn't Balance
Last month I sat in a rented room in Vancouver with bad coffee and a whiteboard that still smelled faintly of somebody else's pitch deck, and I watched a founder try to explain away a single line item.
We were doing diligence on a ZK rollup. Mid-cap, nine-figure raise in 2025, the usual language about institutional-grade validity proofs. The deck was beautiful. The TVL chart was a hockey stick that leaned right. And on my laptop sat the only page that mattered: a four-column model of what it actually costs them to produce one proof.
Proving compute. Prover hardware amortization. Aggregation. Blob space.
The founder talked for eleven minutes about throughput. I let him. Then I asked the question you are never supposed to ask during a bull market: if sequencer fee revenue dropped eighty percent tomorrow, which of these four lines would you still be paying?
He knew. Everyone in the room knew. The compute line does not shrink because the market shrank. It grows — because the batch gets bigger, because the state grows, because the witnesses get heavier, because every new user you onboard makes the next proof marginally more expensive to generate.
The proving line is not a variable cost. It is a mortgage. And right now, this bull market is paying it — cheerfully, unknowingly, and temporarily.
I want to spend the next few thousand words defending that sentence, because the same structural shape shows up in two places you would not expect to find it: inside Europe's stablecoin rulebook, and inside the interest rate curves that Aave and Compound have been running since DeFi Summer. Three systems that describe themselves as mechanism design. Three parameters that a bull market is quietly subsidizing.
What the Blobs Hid
EIP-4844 shipped in March 2024 and handed every rollup a gift nobody fully priced in. Before it, data availability was the executioner. You paid Ethereum L1 gas to post your L2 state to calldata, and that line dominated every operating model in the sector — often eighty, ninety percent of the marginal cost of a rollup transaction. The proposal that became 4844 carved out a separate fee market for blob space: a new resource with its own elasticity, its own base fee, its own congestion dynamics, decoupled from the general gas market that L2s had been competing in.
Typical L2 data costs fell by an order of magnitude. Some operators reported reductions north of ninety percent on their DA line, and for two glorious quarters the industry behaved as though it had solved scalability.
It hadn't. It had solved one input cost, and in doing so it had made a different line visible.
Here is the part that took me longer to see than I'd like to admit: verification and proving are not symmetrical operations, and the industry treats them as though they are. Verifying a SNARK on-chain costs somewhere in the neighborhood of two to three hundred thousand gas. Cheap. Bounded. Predictable. The kind of thing a sharp intern fixes in an afternoon with a better pairing check and a smaller public input set.
Proving that same SNARK off-chain is a different animal entirely. You are running FFTs large enough that they don't fit in GPU memory without decomposition. You are generating witnesses whose size grows with the state the proof has to reference — and state, as a rule, only moves in one direction. You are executing multi-scalar multiplications that saturate memory bandwidth long before they saturate compute, which means the bottleneck is not the thing you can buy your way out of by adding cards.
When I retreated to Vancouver's rain in 2022 to bury myself in ZK-rollup architecture, this was the detail that reorganised how I thought about the whole stack. Everyone was arguing about the verification side, because that's the side that touches L1 and shows up in a block explorer. The proving side was invisible. It happened off-chain, in someone's cluster, against someone's electricity contract, and it did not appear anywhere on a dashboard.
But it's the line that decides who survives the next winter.
Proving cost is a function of state, and state is a function of adoption, which means your cryptographic security gets more expensive the more successful you become. That is a strange property for a technology sold on the premise that it scales. And for eighteen months, nobody noticed, because fee revenue was growing faster than the proving bill. The correlation looked like a business model.
It was a coincidence.
The Four-Line Model
The model I was shown in that conference room broke the cost of producing proofs into four lines. I've since rebuilt it three times for three different rollups, and the shape holds.
Computation. Reserved GPU capacity, or FPGA clusters, or — increasingly — custom silicon. The distinction between reserved and spot capacity matters more than people think. Proving is a long-running, memory-hungry job. If you're bidding on spot instances and you get preempted four hours into a thirty-minute proof's worth of precomputation, you start over. So serious operators reserve. Reserved means fixed. Fixed means it doesn't care what your fee revenue did this month.
Hardware amortization. H100-class accelerators ran somewhere between twenty-five and forty thousand dollars a card through the last cycle, and you don't buy one, you buy racks. Depreciate over two to three years — and then confront the resale market when the next generation lands and your entire fleet becomes a stranded asset. This is balance-sheet risk wearing a cryptography costume.
Aggregation. Individually verified proofs are too expensive to post one at a time, so you recursively fold them: many proofs in, one proof out, one cheap verification on L1. The economics of aggregation are peculiar. The cost is essentially fixed per aggregation window. A rollup that processes one transaction in a batch pays almost exactly what a rollup processing a million pays. Which means aggregation is pure deadweight during quiet periods and free money during busy ones.
Blob space. The line everyone celebrates. The line that, in a quiet week, costs almost nothing, and in a congested week of blobscriptions costs more than everything else combined.
Now do the division. If a prover cluster runs roughly one hundred and eighty thousand dollars a month in reserved capacity and amortization, and the rollup settles four million transactions in that month, pure proving lands around four and a half cents per transaction. Halve demand to two million and you're at nine cents. Drop to four hundred thousand — a bad month, a bear month, a month where the incentive program ended — and you're staring at forty-five cents of proving per transaction against a fee that was designed around a fraction of a cent.
Your unit economics are worst precisely when you need them to be best. That is the inversion at the heart of every ZK rollup operating model, and no amount of clever circuit design removes it. You can only concatenate more batches into a single proof, and concatenating batches adds latency, and latency is not free. It's a trust window, and I'll come back to that.
There's a second layer of circularity that I find genuinely uncomfortable. Many rollups pay their provers in their own token. Which means the proving bill isn't denominated in dollars or euros. It's denominated in dilution. In a bull market that feels like a magic trick — the token appreciates, the prover's real yield appreciates, the treasury prints, everyone congratulates each other on incentive alignment. In a bear market you are paying a real electricity bill in an asset that is down eighty-five percent, and your provers — who have their own costs, who are not charities — will tell you so.
You have not outsourced your cost structure. You have converted an operating expense into a monetary policy.
I know that feeling from the other side. In 2020, with EquiSwap, I built balanced liquidity pools and exotic yield strategies with more enthusiasm than discipline, and the whole thing came apart when the market shifted under it. What I learned from that failure was not that the math was wrong. The math was fine. What was wrong was that I had built a system whose viability depended on a condition I could not control and had not stress-tested. Every ZK rollup operating today is running my 2020 mistake at a nine-figure scale.
The Thirty Percent Line
Let's leave cryptography for a moment and go to Brussels, because the shape repeats.
MiCA's stablecoin regime, and the technical standards that flesh it out, impose reserve and liquidity requirements on e-money tokens and asset-referenced tokens. Under the regulatory technical standards governing liquidity, a qualifying reserve portfolio has to sit substantially in deposits or highly liquid instruments carrying minimal market risk — with a meaningful floor parked as deposits at credit institutions, and a cap on how much of the reserve can concentrate inside any single one.
Stand that requirement next to the economics of a small issuer and something ugly appears.
A euro-denominated e-money token with, say, forty million euros outstanding is not a large business. It has a spread. It earns whatever the reserve portfolio earns and it keeps a slice. Now layer on the bank deposit floor, the concentration cap, the custodian arrangements, the segregation and safekeeping rules, the quarterly reporting, the recovery plan, the redemption-at-par obligation that operates as a standing liquidity put against your own balance sheet.
And that's before authorization. A CASP licence in a member state means legal opinions, own-funds requirements scaled to the activity class, governance and fit-and-proper assessments, complaints handling, outsourcing rules, wind-down planning, and the ongoing cost of holding the compliance headcount that keeps all of it true. Drafting the paperwork is the cheap part. Living inside it is the mortgage.
So here's what I want you to sit with. Nobody in the European legislative process wrote a sentence that said small stablecoin issuers are unwelcome. There was no vote to exclude them. There was no explicit threshold that reads "you must be this large to play." They defined a fixed cost floor, and the arithmetic did the excluding for them.
Which is structurally identical to the proving line. In both cases, a parameter that presents itself as an engineering decision — a reserve ratio, a concentration cap, a compute budget — functions as an entry barrier. In both cases, the cost does not scale down with your revenue. In both cases, a bull market makes the number feel affordable, and everyone stops looking at it.
The difference is that one of these cliffs is voluntary and the other is law.
I spent the back half of 2024 designing governance for a tokenized real-world-asset fund whose whole mandate was to sit on the seam between institutional compliance and decentralization. I built a hybrid sovereignty model — on-chain voting wrapped in off-chain legal structures — and I'm proud of it. But I want to be honest about what that work taught me: the compliance layer is not an appendix to these systems. It is load-bearing. And any framework that can only be afforded by the top ten issuers in a jurisdiction is not a framework that protects users. It's a framework that selects owners.
Code is law, but people are the soul. And the soul of a stablecoin is not the reserve attestation. It's the person in Lagos or Manila or Medellín holding a hundred units of it because the alternative is a banking system that won't return their calls. There is no reserve ratio at which that person stops mattering, and no ratio at which they become an acceptable casualty of prudential design.
The Kink Is a Vote
Last cliff. This one is inside the building.
Open Aave V3's variable rate model and you'll find a piecewise linear function. Below an optimal utilization point, the borrow rate climbs gently with utilization. Above it, a second, much steeper slope kicks in and rates go vertical. Compound's jump rate model is the same animal wearing different variable names: a base rate per block, a multiplier, a kink, and a jump multiplier past the kink. Every lending market in DeFi is built on this skeleton.
These parameters are set by governance. And I want to be precise about what that means, because the industry has a habit of dressing it up.
There is no clearing process that produces the optimal utilization number. No borrower bid for it. No lender offered it. It is not the price at which supply and demand met, because there is no order book and no auction and no crossing engine. It is a number that a working group chose, usually somewhere between seventy-five and ninety percent, ratified by token holders who mostly could not derive it if you asked them to. The kink is not discovered by the market. The kink is a vote.
And once you see it that way, you see what it's doing. A governance-set parameter is a subsidy term in disguise. When utilization runs hot and the second slope activates, borrowers pay punishing rates that exist for one purpose: to drag utilization back toward a number a committee chose. Those extra fees don't vanish. They accrue to suppliers and to the treasury. In a bull market nobody complains — everybody's earning, leverage is cheap, the liquidations are someone else's problem. In a bear market the jump multiplier becomes the mechanism that clears collateral at the worst possible moment, and the people it clears are, predictably, the ones with the least room.
Here's the thing that ties all three cliffs together. None of these parameters can be voted to the "correct" value, because there is no correct value. There is only the vote, and the vote reflects the preferences of whoever holds the most tokens. That is true of Aave's kink. It is true of a reserve concentration cap written by regulators who will never hold the token. And it is true of a prover's compute budget, decided by a foundation that has to be solvent in dollars while its users think in tokens.
Three systems. Three claims to mechanism design. Three numbers that a group of humans decided were reasonable.
Decentralization is a verb, not a noun — and a verb is something you have to keep doing, on purpose, after the spreadsheet stops looking good.
The Pragmatism Test
Now let me argue the other side, because I don't entirely trust my own instincts here and you shouldn't either.
What if the cost cliff is the point? What if consolidation in proving isn't a failure of decentralization but the mechanism that produces it?
Run the numbers honestly. The prover market is a commodity compute market with brutal economies of scale, and the only real moats are capital access and hardware supply chains. A ZK ecosystem with forty underfunded provers is not more decentralized than one with six well-capitalized ones. It's more fragile. It's more likely to experience a correlated failure during a stress event, because all forty are running the same generation of cards on the same thin margins and all forty will go offline in the same quarter when the token that pays them halves.
Six provers with two-hundred-million-dollar balance sheets will still be producing proofs after a bad year. Forty provers with two-million-dollar balance sheets will not. Counting is not a security model. And this is the industry's deepest blind spot: we have inherited a habit of measuring decentralization by counting nodes, validators, or operators, as though the property were a census rather than a capacity question. The right question is never "how many." It's "how many entities can afford a bad quarter."
My second, sharper objection is about latency, and it's the one I'd put to any founder across a table.
Generating a validity proof for a large batch is not instant. Under load it can take tens of minutes. During that window, what exactly is securing your chain? Not the proof — it doesn't exist yet. The sequencer is. The sequencer's promise that it will, eventually, publish something that a contract on L1 will accept. The escape hatch — forced inclusion through the L1 contract — is the only genuine guarantee in the system, and it is slow, and it is rarely exercised, and the number of users who know how to use it is approximately zero outside a Discord channel of researchers.
So the honest description of a ZK rollup under load is this: a centralized sequencer issuing a cryptographic receipt that arrives later. Trust isn't verified on-chain during the interval that matters. It's escrowed, in the reputation of an operator, for the length of a proving cycle. Which is fine. Escrow is a real thing. But it is not the thing that's on the marketing page.
Now apply the pragmatism test. Ask any of these systems one question: if your token went to zero tomorrow, would your operators keep producing proofs, your lenders keep supplying, your issuers keep issuing?
If the answer is no, then what you have is not a cryptographic guarantee. It's a business. Businesses are fine — I've run three of them and lost money on two. Just don't call it trustlessness. Call it a business with unusually good receipts.
Where This Goes
The forward-looking part is always the hardest to write honestly, because the temptation is to predict a correction. I don't think there's a dramatic one coming. I think there's a slow, unglamorous reshuffling that most people will miss because it happens in operating models rather than price charts.
Proving consolidates. Not into six independent operators, but into a handful of vertically integrated firms that own their hardware supply, their aggregation layer, and eventually their own silicon. The aggregation step becomes a public utility with regulated-ish throughput guarantees, because that's the only way the fixed cost stops being deadweight. Rollups that can't amortize it will not shut down — they'll outsource it, which means they'll be renting their security from a competitor, which is a governance fact that will be discovered the way such facts are always discovered, in the middle of a bad week.
In Brussels, the thresholds get quietly revisited. Not because anyone admits the reserve floor was a mistake, but because the same policy apparatus has an explicit strategic interest in euro-denominated digital payments, and you cannot build a competitive euro stablecoin ecosystem on top of a cost structure that only four institutions can carry. Watch for the language of "proportionality" — it's the tell.
And the kink parameters get moved. Again. By vote. In whichever direction protects the largest suppliers at the moment of the vote, because that is what governance does when the people who show up are the people with the most at stake. I've watched enough of these votes now to stop being surprised by the outcome and start being curious about the turnout.
None of this is a reason to abandon the project. It's a reason to be precise about it. I lost a treasury in 2017 to a multisig design that was technically sound and philosophically bankrupt, and the lesson I took from that was not that decentralization is impossible. It was that decentralization is a continuous engineering practice, not a property you acquire by shipping a contract.
So here's what I'd ask you to do the next time someone shows you a rollup dashboard with a green number climbing to the right. Don't ask about throughput. Don't ask about TVL. Ask which line in their operating model is a mortgage — the one that stays fixed while revenue moves. Ask who's paying it. Then ask what happens on the day they stop.
The answer tells you more about the next five years of this industry than any roadmap will.
Decentralization is a verb, not a noun. Someone has to keep doing it, every quarter, with the spreadsheet open.
