Crypto glossary
Proof aggregation (recursive proofs)
Proof aggregation combines many zero-knowledge proofs into a single proof, often through recursion, so a blockchain verifies one proof instead of many.
Verifying a zero-knowledge proof on Ethereum costs gas, and that cost is roughly fixed per proof. Proof aggregation compresses many proofs into one. With recursion, a prover generates a proof that it has correctly verified other proofs; repeat the step and thousands of transactions, blocks or even separate rollups end up attested by a single succinct proof posted on chain.
This is how ZK rollups keep fees low as they grow: the cost of the final verification is shared across every transaction it covers. Aggregation layers go further and batch proofs from several chains, which lowers costs for smaller rollups and can speed up messaging between them. Proving markets and zkVMs rely on the same technique to split large computations into pieces that are proven in parallel and then folded together.
Aggregation adds latency, because the system waits to collect proofs before compressing them, and it makes the prover stack more complex. A bug in the recursive circuit can undermine every proof it wraps, and an aggregator can become a bottleneck or point of censorship if only one party runs it.
Example
A ZK rollup proves each of its batches separately, then wraps a few hundred of those proofs into one recursive proof that Ethereum verifies in a single transaction.