Aztec Discloses a Critical Flaw That Lets a Forged Proof Pass Verification

Aztec, the privacy-focused layer-2 network on Ethereum that runs private smart contracts, disclosed a critical vulnerability in the proving system behind its Alpha V5 release. Contributors identified the defect on 27 July through internal auditing assisted by artificial-intelligence tooling. Aztec states that an attacker may be able to construct a proof that passes verification for a transaction the network should reject, and that funds, applications and contract state on V5 should be treated as exposed until incident response finishes and operators complete the required network actions.

This is a soundness failure, not a bug in an application contract. A zero-knowledge rollup replaces re-execution with a mathematical proof, so if the verifier can be convinced by an invalid proof, the protocol has no additional check behind it. Validators cannot catch the problem by re-running transactions, because the design deliberately removed that step. That is what separates proving-system defects from ordinary smart-contract exploits and why teams disclose them on a schedule tied to upgrades rather than immediately.

It is also the second such disclosure in the same code lineage this year. Aztec previously told V4 users to withdraw ahead of a June deadline after a critical flaw the team said affected the proving system as a whole. V5, released with roughly halved private-transaction proving costs, remains labeled alpha software, and Aztec has said this is the phase in which findings of this kind surface. No exploitation has been reported.