Look at the gas fees on StarkNet's Goerli testnet block 14203. The cost to process a single, simple ERC-20 transfer is still an order of magnitude higher than a comparable transaction on Arbitrum One. We are told StarkNet is the future of Ethereum scaling. We are told recursive proofs will solve everything. But the data on the proto-danksharding precompiles tells a different story—one of a cryptographic trade-off that the marketing material conveniently ignores.
This is not about which L2 is 'better.' It is about understanding the operational cost of architectural choices. The code does not lie, but the auditor must dig.
Context: The Promise of the 'Validity Rollup' Sovereign
StarkNet is a Validity Rollup (ZK-Rollup) using STARK proofs. Unlike Optimistic Rollups (like Arbitrum or Optimism), which assume transactions are valid unless challenged, StarkNet generates a cryptographic proof (a STARK) that mathematically verifies the correctness of every batch of transactions. This proof is then posted to Ethereum L1. The promise is 'trustless finality': you don't need to wait a week-long dispute period. The proof is the final word.
The key differentiator StarkWare champions is the use of recursive proofs. Instead of generating one massive proof for thousands of transactions—which would be computationally expensive and large—they recursively verify proofs of smaller batches, creating a chain of proofs that eventually results in one single proof. This was supposed to be the silver bullet for cost efficiency. Based on my audit experience, when a protocol promises a silver bullet, it is time to inspect the caliber.
Core: Tracing the Gas Trail to the Root Cause—The SHARP Serialization Overhead
Let's dig into the code. The bottleneck isn't the proving time itself, but the cost of posting the data to L1. StarkNet uses a centralized sequencer called SHARP (Shared Prover). After generating the recursive proof, SHARP must submit this proof and the associated data to the Ethereum L1 StarkVerifier contract. The cost of this submission is dominated by calldata gas.
Here is the critical finding: The STARK proof itself is inherently large. A typical STARK proof for a block of 10,000 transactions is around 45-50 kilobytes. A SNARK proof (as used by zkSync Era) for the same block is roughly 300-500 bytes. The difference is two orders of magnitude.
This is not a bug. It is a feature of STARKs. STARKs are post-quantum secure and require no trusted setup. SNARKs are smaller but rely on a trusted setup (a ceremony). However, this optimization choice has a direct and quantifiable impact on end-users.
To demonstrate, consider the processMemoryOp in the Cairo OS. The Cairo Virtual Machine (Cairo VM) is the execution environment for StarkNet. Every memory operation is recorded in the trace. For recursive proofs to work, the prover needs to include the entire execution trace for the 'outer' proof, which includes all the memory access patterns of the inner proofs. This creates an exponential-like overhead in the data required to be posted on-chain.
Let's look at the cairo_prover::service::ProofSubmissionService pseudocode:
