Aztec Discloses Critical Soundness Flaw in Its Alpha v5 Proving System

Aztec, the privacy-focused Ethereum layer-2 network, disclosed a critical vulnerability in the proving system behind its Alpha v5 release. Core contributors identified the defect on July 27 through internal auditing assisted by AI code analysis. The disclosure describes a soundness failure: an attacker could build a proof that passes verification for a transaction the network's rules should reject.

Soundness bugs belong to a different risk class than smart-contract exploits. When a contract is exploited, the chain agrees on what happened, and the loss is bounded by the contract's balance. When a proving system accepts an invalid proof, the chain agrees on something false, and on a network where state is encrypted, the discrepancy is harder for outside observers to detect. Validator re-execution, the fallback most optimistic rollups rely on, does not apply to a system whose entire security argument is the proof itself.

This is the second such disclosure from Aztec in five months. In March the team disclosed a critical vulnerability affecting the Alpha v4 proving system and told v4 users to withdraw funds before June 25, when an on-chain governance vote forced public disclosure. Aztec says reviewers have not identified other high-severity or critical defects in v5 at this time, and its bug bounty on Cantina has drawn more than 234 researchers.

The pattern matches what the privacy sector itself argues. Miden, a competing privacy chain, writes that most blockchains today are not private and that few users understand what that means in practice. The opposite risk is now just as visible: the systems that do deliver confidentiality carry a verification surface that only a small number of cryptographers can review, and repeated critical findings suggest that surface has not been fully tested.