Every figure here comes from real testnet transactions, not local estimates.
Gas per action
Monad charges the declared gas limit, and that limit is public. So every user action
declares one identical envelope — otherwise the limit itself would reveal which private action
you took.
Local forge figures understate real cost by 32–55% — they charge neither calldata, the
intrinsic transaction cost, nor true cross-contract cold access. Every number above is measured
on chain.
Proving, client-side
Proofs are generated in your browser. Your secrets never leave the device, which means the
circuit artifacts have to be downloaded once.
Artifacts are cached after first use and loaded per action, so a first bet fetches what it
needs and later ones are instant.
bet_encrypted is the largest because the ElGamal encryption happens inside the proof — that
is the step that hides your stake, and it is worth what it costs.
Batching
Inserting a commitment into the tree costs more gas than a single action can carry. So actions
queue their commitment and the sequencer grafts 64 at a time — a 15.9× saving per leaf.
Batching is a requirement of the gas budget, not an optimisation.
Mechanism notes
Parimutuel dilution. Money arriving after you changes your payout. That is a property of
pooled markets and applies to every participant equally.
Fixed denominations. Deposits and withdrawals use a set ladder of sizes. An unusual amount
would identify its owner and shrink the anonymity set for everyone, so the contract enforces
the ladder rather than leaving it to convention. 
