# Aztec Discloses a Second Consecutive Critical Flaw in the Proving System Behind Its Privacy Network

Core contributors found the Alpha V5 defect on July 27 through internal artificial-intelligence-assisted auditing, and validator re-execution, the fallback most rollups rely on, does not catch it.

- Published: 2026-08-12T05:36:54.490Z
- Canonical: https://polylog.news/crypto/2026-08-12/aztec-discloses-a-second-consecutive-critical-flaw-in-the-pr
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Aztec Network](https://aztec.network/blog/alpha-v5-proving-system-vulnerability), [Aztec Network (Alpha V5)](https://aztec.network/alpha-v5), [Aztec Network (Dark Forest)](https://aztec.network/blog/dark-forest-aztec-game-goes-live)

Aztec, the Ethereum layer-2 network built for private smart contracts, has published the details of a [critical vulnerability in the proving system](https://aztec.network/blog/alpha-v5-proving-system-vulnerability) of its Alpha V5 release. Core contributors identified the defect on July 27 through internal auditing assisted by artificial-intelligence tools, and told users to treat funds, applications and contract state on V5 as exposed to a protocol-level failure until incident response finished.

The sequence matters more than any single bug. Aztec found a [critical flaw in the Alpha V4 proving system](https://aztec.network/blog/critical-vulnerability-in-alpha-v4) on March 17, kept the details private, urged users to withdraw before the June 25 governance vote, and shipped the fix inside [V5](https://aztec.network/alpha-v5) in July. Weeks later, the replacement system produced its own critical finding. Aztec has been explicit that this class of defect is not mitigated by public re-execution by the validator committee.

That single fact defines the entire risk. Most rollups assume that if a proof is wrong, honest validators re-running the transactions will notice. A soundness defect in the proving system itself breaks that assumption, because the fraudulent state can be accompanied by a proof the verifier accepts. On a privacy network the problem is more severe, since the data needed to spot an inconsistency by inspection is encrypted by design.

Aztec is shipping in parallel with the disclosures. The network has [live applications](https://aztec.network/blog/dark-forest-aztec-game-goes-live), including a private version of the strategy game Dark Forest, and has published how its [gas accounting works](https://aztec.network/blog/how-gas-works-on-aztec) for private and public execution. Ethereum's layer-2 ecosystem now secures $39.40 billion in total value, according to L2Beat, concentrated in Base Chain at $11.62 billion and Arbitrum One at $10.19 billion, both rated Stage 1. Aztec's disclosures preview the review burden those larger systems will inherit as they move more logic behind proofs.

## What this means

Proof soundness is a single point of failure that sits underneath every application on a zero-knowledge rollup, so a defect there exposes all users at once rather than the customers of one protocol. Teams that rely on validator re-execution as a backstop, and the users who trust rollup bridges holding deposits, are the exposed parties. The practical consequence is a slower and more expensive path away from the safeguards current rollups depend on: escape hatches, upgrade keys and multi-prover setups stay in place longer, keeping in force the governance risk that decentralization claims were supposed to remove.

## What to watch

- Whether other zero-knowledge rollups publish comparable proving-system disclosures, which would establish this as an industry-wide defect class rather than one team's implementation problem.
- Whether Aztec moves to multiple independent provers, the standard remedy that lets one system's soundness bug be caught by another.
- How much value users leave on privacy layer-2 networks during embargo periods, a direct measure of whether the disclosure process retains trust.