why does gnark groth16 verify need to cost about 390,000 gas for 4 public inputs?

[xiangjianmeng]

referring to https://hackmd.io/Fa4A8lVKRM2TwVh1dhUb1Q?view=#Comparative-Analysis-of-FFLONK-Gas-Costs and https://hackmd.io/@nebra-one/ByoMB8Zf6 growth16 verify gas cost is about 200,000+.

[ivokub]

One thing is that we are using an additional pairing computation for the "commitment" part of the proof. This is used to allow optimizing the prover runtime by a factor when we use non-native arithmetic.

And afaik every public input adds one more scalar multiplication which also costs significant gas. Usually the approach is to only provide a single public input to the SNARK verifier h = Hash(input1, ..., input4), provide the actual public inputs as a private input (and only h as public input) and add assertion in the circuit that h is correct from the secret inputs. Then, you would also have to compute h in a Solidity contract.

NB! When you use non-native arithmetic, or non-native G1 point, then actually every element consists of more circuits inputs as we represent non-native element as a vector of limbs.