Ethereum’s rollup networks are mispricing small transactions, creating risks that range from inflated user costs to denial-of-service attacks, according to a new study by researchers at zkSecurity, Prooflab, and Imperial College London.

The study, “Unaligned Incentives: Pricing Attacks Against Blockchain Rollups,” was posted on Sunday and detailed how different rollups calculate fees for execution, data availability, and proof costs. It concluded that current fee mechanisms are too simple to balance fairness, security, and usability.

Rollups are layer-2 networks that batch transactions and settle them on layer-1 blockchains like Bitcoin, Ethereum, and Solana to reduce costs and increase capacity. Rollups are central to Ethereum’s scaling roadmap, which relies on these systems to handle high volumes of transactions while the base chain remains limited in throughput.

To operate, rollups must pay for three distinct resources. The first is computation, the cost of executing the transactions inside a batch. The second is data availability, the expense of posting transaction data back to a blockchain so it can be verified. The third is the gas cost for batch settlement and proof verification.

These three costs vary independently, but the study finds that most rollups do not account for them separately. Instead, they often collapse them into a single formula or apply fixed rules, which can distort prices.

According to the researchers, this design means small transfers may be mispriced. Users making low-value payments can end up paying more than necessary, while attackers can take advantage of underpriced transactions to send large volumes of spam at little cost.

The authors benchmarked five major rollups—Polygon zkEVM, zkSync Era, Scroll, Optimism, and Arbitrum—and found wide differences in how fees are set. Some networks fix charges at the time a transaction is submitted, others wait until a batch is sealed, and some issue refunds if the actual cost ends up lower than expected.

Those mechanisms may appear technical, but they create opportunities for exploitation. For example, a refund system can be gamed by attackers who submit large numbers of transactions, then reclaim part of the fee while still consuming network resources.

Beyond user frustration, the paper argues, these weaknesses create systemic risk. If mispricing allows attackers to subsidize small transactions, then they can mount denial-of-service attacks that clog the network, degrade performance, or raise costs for honest users. The problem lies not in faulty code, but in economic design choices that shape incentives.

The study stresses that these issues matter as Ethereum’s rollup ecosystem grows. Rollups today secure tens of billions of dollars in assets, making them high-value targets.

As mitigation, the paper calls for “multidimensional” fee mechanisms that separately price computation, data posting, and proving. Aligning fees with actual resource use, it argues, would make systems more resistant to spam while giving users more predictable costs.

Tools such as dynamic adjustment, partial batching, and disclosure of cost components could all help address the issue. Some rollup teams are already experimenting with adaptive fee curves and real-time modeling, but the study notes that standards are not yet established.

The findings come as Ethereum advances a roadmap built around zero-knowledge proofs and rollup-centric scaling. Zero-knowledge virtual machines, or zkVMs, promise stronger verification of transactions, but they also introduce proving costs that can spike depending on demand and available hardware. Models that do not account for that variability, the paper says, risk breaking down under stress.

For users, exchanges, and wallets, that can mean inconsistent fees and degraded service. For developers and investors, the study’s message is to look beyond headline throughput or nominally low fees and examine how those fees are calculated.