The Bill That Arrives After Every Transaction

You've just bridged funds onto a rollup, paid a fraction of a cent in fees, and now you're staring at the transaction receipt wondering how that's even possible when Ethereum mainnet charges dollars for the same operation. The answer isn't magic. It isn't a subsidy, either. It's a deliberate choice about where data lives on-chain and how it gets written there.

Rollups post compressed transaction data to Ethereum as calldata, not as contract storage. That single architectural decision is why fees are cheaper by roughly one to two orders of magnitude. Understanding it tells you something real about how Ethereum's security model actually works.

The Difference Between a Sticky Note and a Filing Cabinet

Ethereum has two fundamentally different ways to put bytes on-chain.

The first is contract storage: slots in a persistent key-value store that every Ethereum node reads, writes, and keeps forever. Writing 32 bytes to a fresh storage slot costs 20,000 gas. Updating an existing slot costs 5,000 gas, and every node carries that state indefinitely. It's the filing cabinet: expensive to fill, expensive to maintain, and always open for reading.

The second is calldata. The raw input bytes attached to a transaction, included in the block, hashed into the block header, and therefore permanently recorded in Ethereum's history. It is not loaded into the EVM's state trie. Nodes reconstructing history can replay it; nodes running in snap-sync mode don't need to hold it forever. Writing one byte of calldata costs 16 gas (or 4 gas if it's a zero byte, thanks to a longstanding compression incentive baked into the protocol). The sticky note: cheap to attach, permanent in the record, but not sitting in active memory.

For a rollup posting a batch of 200 compressed user transactions, the difference is staggering. Take 200 transactions, each compressed to roughly 12 bytes of essential data (recipient, value, nonce, signature compressed via aggregation): that's about 2,400 bytes. At 16 gas per non-zero byte, the calldata portion costs roughly 38,400 gas total. Spread across 200 transactions, each user's share is about 192 gas. Compare that to storing even a single 32-byte word in contract storage at 20,000 gas. The calldata route is not marginally cheaper. It's categorically cheaper, and any rollup design that ignores this arithmetic is leaving serious money on the table.

What Security Does Calldata Actually Provide?

This is the part most explainers skip.

Posting data to Ethereum isn't only about cost. It's about data availability: the guarantee that anyone who wants to reconstruct the rollup's state can do so by reading Ethereum's chain history. If a rollup operator goes offline, turns malicious, or simply disappears, users can pull every calldata batch ever posted, replay the transactions in order, and independently compute the current state of every account. No one can hold funds hostage by hiding data.

This is what separates a rollup from a pure sidechain. A sidechain carries its own validators and its own security assumptions. A rollup that posts calldata to Ethereum inherits Ethereum's data availability guarantees directly. If the block containing that calldata is finalized, the data is as permanent as Ethereum itself.

Optimistic rollups like Optimism and Arbitrum rely on this property for their fraud-proof windows. A sequencer submits a fraudulent state root: any watcher can pull the original calldata, re-execute the batch locally, generate a fraud proof, and submit it on-chain to slash the sequencer. Without the calldata, that fraud proof is impossible to construct. The calldata isn't decorative. It's the evidentiary record.

ZK rollups like zkSync Era and Starknet post calldata (or, in some configurations, just the inputs needed to verify the proof) for the same reason: so that state can always be reconstructed independently of the operator.

EIP-4844 and the Blob Upgrade: Same Idea, Lower Price

Here's the wrinkle that arrived with Ethereum's Dencun upgrade: blobs.

EIP-4844 introduced a new transaction type that lets rollups attach data in a separate blob field rather than ordinary calldata. Blobs are designed to be pruned by full nodes after a short window, roughly 18 days in the initial spec. During that window, the data is available on the peer-to-peer network for anyone to download. After it, only archival nodes and dedicated data availability layers keep it.

Eighteen days is more than enough time for fraud proof windows (Arbitrum's is 7 days, Optimism's is 7 days) and for ZK proof verification (which happens within minutes to hours). The security guarantee is preserved even though the data isn't kept by every node forever. Think of blob space as a dedicated freight lane carved out of the highway specifically because the main lanes were getting congested: structurally cheaper, separately priced, and built for exactly this use case.

Blob space has its own fee market. When blobs are uncongested, rollups pay dramatically less than they would with calldata. When blob space fills up, the price rises, but it's still structurally cheaper than contract storage.

The core principle hasn't changed. Data is made available to Ethereum's network long enough for any security-critical check to happen, then it can be pruned. The filing cabinet never needed to hold it permanently.

What People Get Wrong About This

The common misconception is that rollups are "storing their transactions on Ethereum." They're not, at least not in the sense most people mean. The rollup's state (account balances, contract code, storage) lives on the rollup. What gets posted to Ethereum is the inputs required to recompute that state if needed.

Ethereum keeps the court record: a permanent transcript of what instructions were submitted, in what order, attested by the sequencer's signature. The rollup keeps the warehouse: the actual live inventory of who owns what. If the warehouse burns down, you rebuild it from the court record. You don't store the warehouse inside the courthouse.

The second thing people get wrong, and this one matters more: cheaper calldata does not mean weaker security. The security comes from availability and ordering, not from the data living in expensive storage slots. As long as the data is in a finalized Ethereum block, it's ordered, timestamped, and tamper-evident. That's all the rollup's security model requires. Confusing cost with robustness is the kind of mistake that leads people to trust a cheap network they don't actually understand.

The Practical Upshot

So here's the question worth asking before you trust a rollup with real money: where does it post its data, how long is it available, and does the fraud window or validity proof fit inside that availability window?

A rollup that posts nothing to Ethereum, or posts only a state root without the supporting data, is making a very different security bet than one that posts full calldata or blobs. The fee savings might look identical from the outside. The trust assumptions are not.

Cheap is easy to copy. The hard part is staying cheap while keeping the receipts.