Aztec Discloses a Second Consecutive Critical Flaw in the Proving System Behind Its Privacy Network

Aztec, the Ethereum layer-2 network built for private smart contracts, has published the details of a critical vulnerability in the proving system of its Alpha V5 release. Core contributors identified the defect on July 27 through internal auditing assisted by artificial-intelligence tools, and told users to treat funds, applications and contract state on V5 as exposed to a protocol-level failure until incident response finished.

The sequence matters more than any single bug. Aztec found a critical flaw in the Alpha V4 proving system on March 17, kept the details private, urged users to withdraw before the June 25 governance vote, and shipped the fix inside V5 in July. Weeks later, the replacement system produced its own critical finding. Aztec has been explicit that this class of defect is not mitigated by public re-execution by the validator committee.

That single fact defines the entire risk. Most rollups assume that if a proof is wrong, honest validators re-running the transactions will notice. A soundness defect in the proving system itself breaks that assumption, because the fraudulent state can be accompanied by a proof the verifier accepts. On a privacy network the problem is more severe, since the data needed to spot an inconsistency by inspection is encrypted by design.

Aztec is shipping in parallel with the disclosures. The network has live applications, including a private version of the strategy game Dark Forest, and has published how its gas accounting works for private and public execution. Ethereum's layer-2 ecosystem now secures $39.40 billion in total value, according to L2Beat, concentrated in Base Chain at $11.62 billion and Arbitrum One at $10.19 billion, both rated Stage 1. Aztec's disclosures preview the review burden those larger systems will inherit as they move more logic behind proofs.