Grouped bar chart comparing BN254 vs BLS12-381 on-chain gas costs for every precompile operation: G1/G2 adds, scalar mults, and pairings. Log scale reveals the G2 MUL unlock and the counterintuitive pairing inversion.
Every zkSNARK bottoms out in a pairing check. Before Pectra you had BN254 at ~100-bit security. EIP-2537 added BLS12-381 at 128 bits, and its pairings are cheaper: 32,600k+37,700 vs 34,000k+45,000 gas. G2 MUL dropped from millions to 22,500 gas.